Overview

overview

10

Static

static

3

2026-08-04...ck.exe

windows10-2004-x64

10

2026-08-04...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 08:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
  • Size 1.6MB
  • Sample260804-jypvbazwbt
  • SHA256 e9846b6846473cf180081389365f364c76c618937f2fd3a45c2b98f01fd5fde0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 64 IoCs
    defense_evasiontrojan
  • Renames multiple (163) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4872
    • C:\Users\Admin\nqYUYoQU\hmEooIYM.exe
      "C:\Users\Admin\nqYUYoQU\hmEooIYM.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4628
    • C:\ProgramData\vIAMUgso\bucIcUMI.exe
      "C:\ProgramData\vIAMUgso\bucIcUMI.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2036
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4444
      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2484
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2068
          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1436
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1816
              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1440
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5040
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4792
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2520
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3592
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:744
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:1664
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:1032
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4120
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:3056
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:5048
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:1160
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3992
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          PID:3084
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3048
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                              22⤵
                                                PID:4184
                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                  23⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4152
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                    24⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2244
                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                      25⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3996
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                        26⤵
                                                        • Executes a command shell one-liner
                                                        PID:5084
                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                          27⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:720
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                            28⤵
                                                            • Executes a command shell one-liner
                                                            PID:2952
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                              29⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:4432
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                30⤵
                                                                • Executes a command shell one-liner
                                                                PID:896
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                  31⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:2696
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                    32⤵
                                                                      PID:5088
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                        33⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:4296
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                          34⤵
                                                                            PID:2672
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                              35⤵
                                                                                PID:4220
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                  36⤵
                                                                                  • Executes a command shell one-liner
                                                                                  PID:1820
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                    37⤵
                                                                                      PID:1864
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                        38⤵
                                                                                        • Executes a command shell one-liner
                                                                                        PID:564
                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          39⤵
                                                                                            PID:4232
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                            39⤵
                                                                                              PID:4316
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                40⤵
                                                                                                  PID:984
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                    41⤵
                                                                                                      PID:1408
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                        42⤵
                                                                                                          PID:2052
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                            43⤵
                                                                                                              PID:4460
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                44⤵
                                                                                                                  PID:3752
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                    45⤵
                                                                                                                      PID:4436
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                        46⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:1156
                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          47⤵
                                                                                                                            PID:3396
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                            47⤵
                                                                                                                              PID:988
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                48⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:2704
                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  49⤵
                                                                                                                                    PID:1756
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                    49⤵
                                                                                                                                      PID:4856
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                        50⤵
                                                                                                                                          PID:5836
                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                            51⤵
                                                                                                                                              PID:5848
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                              51⤵
                                                                                                                                                PID:5896
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                  52⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:5712
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                    53⤵
                                                                                                                                                      PID:4684
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                        54⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:3224
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                          55⤵
                                                                                                                                                            PID:5232
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                              56⤵
                                                                                                                                                                PID:5448
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                  57⤵
                                                                                                                                                                    PID:5512
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                      58⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:812
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                        59⤵
                                                                                                                                                                          PID:3776
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                            60⤵
                                                                                                                                                                              PID:1364
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                61⤵
                                                                                                                                                                                  PID:3804
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                    62⤵
                                                                                                                                                                                      PID:5860
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                        63⤵
                                                                                                                                                                                          PID:5648
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                            64⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:3184
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                              65⤵
                                                                                                                                                                                                PID:4128
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:5196
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                    67⤵
                                                                                                                                                                                                      PID:700
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                          PID:5536
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                            69⤵
                                                                                                                                                                                                              PID:5660
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:3904
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                  71⤵
                                                                                                                                                                                                                    PID:5424
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                        PID:4972
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                          73⤵
                                                                                                                                                                                                                            PID:2180
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                              74⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:1240
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                75⤵
                                                                                                                                                                                                                                  PID:5880
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:4620
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                      77⤵
                                                                                                                                                                                                                                        PID:5180
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                            PID:5432
                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                              79⤵
                                                                                                                                                                                                                                                PID:3444
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                79⤵
                                                                                                                                                                                                                                                  PID:5564
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:4744
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                      81⤵
                                                                                                                                                                                                                                                        PID:5168
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:1180
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                                                              PID:5856
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:5908
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:4868
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:1756
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                      87⤵
                                                                                                                                                                                                                                                                        PID:5268
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                          88⤵
                                                                                                                                                                                                                                                                            PID:4728
                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                              89⤵
                                                                                                                                                                                                                                                                                PID:6000
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                                                                                  PID:5652
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                                      PID:3220
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                                                                                                          PID:4636
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:4712
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                                                                                                                PID:5368
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                                                                                                    PID:5136
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                                                                                                        PID:2516
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                                                                                                          PID:2504
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                                                                                                              PID:6056
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                                                                                                                  PID:5964
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                                                                                                      PID:2716
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                                                                                                                          PID:3080
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:4288
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                                                                                                                                PID:4528
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                                    PID:5552
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                                                                                                        PID:2312
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                                                                                                                            PID:2968
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                                                                                                                                PID:4304
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1412
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                                                                                                                        PID:6100
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4900
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2692
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:5156
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:5736
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:4404
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2220
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5596
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:6016
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2268
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:1208
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:6068
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:6000
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5556
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:872
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2632
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1488
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:848
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5348
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iGgwEAcc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1888
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CYgoUMEk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:544
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1984
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Xeggcocs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5556
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3304
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tEIIkQMA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hGIgAYAU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:816
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fiQwAgwk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1388
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CagoEowA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1064
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\guMoYgwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5588
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:840
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mIIcAUEE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2428
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WacEUoME.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:728
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2980
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:752
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jQwUUAsQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2712
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\loosUokg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2632
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XEswAYsI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xkUwEUkA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4068
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oSEAYAMU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SawQYgEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WygkAQAE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3644
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ViIcoIMU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5188
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pGgscEIQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:752
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1308
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tqEcQcoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hMgMgYMU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mOYQAkog.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                              91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uKwcwoYs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                          88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                          88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                              89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UekIYcwY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                            86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                              87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2564
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vwYQQgkI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3644
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2712
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NGMMUkgY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3060
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5264
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RAUYcIUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1916
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1388
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5480
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EyEYEYoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GkcwoAAw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5160
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mkkgMcIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kEQIoIoM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1488
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1204
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DskMQUos.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5168
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BcocgkwM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:312
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                  71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                              69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:872
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nkkIAccg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3304
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2632
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IMcEwwoA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:728
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MQgAkocY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YaAUIsYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3936
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YOEMkMIY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2708
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5264
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:848
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RUYksIoY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                          59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      57⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PQQcwcEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                            57⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                              57⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4720
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3080
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3528
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RYkMkMMY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                              55⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:688
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                            53⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CYsAEEYg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                              53⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                          50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EKYQoYcc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                              51⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:840
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                            48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                              49⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2428
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qSwAMgUo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  49⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    49⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                              46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                              46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NgIYMQQs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    47⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                              44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\msEogIEM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      45⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4720
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oWQEUUQA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    43⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                              40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1488
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                              40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1956
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xYsMYsYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  41⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                            38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                            38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                            38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:948
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IawUQUcY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                            38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                              39⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1960
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                        36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1636
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                          36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VCQgYIcg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                          36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2128
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                            37⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                      34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:820
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WYwMQIII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:980
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                          35⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:224
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ACooMsws.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                      32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                        33⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:848
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\skQYIYIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                        31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:812
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:900
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TEMEAUwc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:456
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      29⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:760
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DiosEMMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              24⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              24⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                              24⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:224
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NmwAokAA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                              24⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                25⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2088
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                          22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1984
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                          22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4032
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:564
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YQEAQcko.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                23⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3244
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:740
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EoAEssME.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2004
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                21⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3608
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TkIooEcM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                19⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1888
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\voAcIIEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2460
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1828
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xsgAogAg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:452
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2704
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:908
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IWQYQIwc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:740
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IAgwUEQk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FmQgwYQk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1888
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jEgAckUE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:768
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:872
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2428
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xyoYIckg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1596
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:452
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1488
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VYAAgMoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\tmEcgksk\KiIkscEo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\ProgramData\tmEcgksk\KiIkscEo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3924
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\nqYUYoQU\hmEooIYM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\nqYUYoQU\hmEooIYM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\vIAMUgso\bucIcUMI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\ProgramData\vIAMUgso\bucIcUMI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3608
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2124

                                                                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                                                                                                                                                                                                              Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                                                                              T1059

                                                                                                                                                                                                                                                                                                                                                                                                                              Visual Basic

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1059.005

                                                                                                                                                                                                                                                                                                                                                                                                                              Windows Command Shell

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1059.003

                                                                                                                                                                                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                              Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1548

                                                                                                                                                                                                                                                                                                                                                                                                                              Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                              Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1548

                                                                                                                                                                                                                                                                                                                                                                                                                              Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                                              Hide Artifacts

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1564

                                                                                                                                                                                                                                                                                                                                                                                                                              Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1564.001

                                                                                                                                                                                                                                                                                                                                                                                                                              Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1562

                                                                                                                                                                                                                                                                                                                                                                                                                              Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1562.001

                                                                                                                                                                                                                                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                              4
                                                                                                                                                                                                                                                                                                                                                                                                                              T1112

                                                                                                                                                                                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                              Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1555

                                                                                                                                                                                                                                                                                                                                                                                                                              Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1555.003

                                                                                                                                                                                                                                                                                                                                                                                                                              Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1552

                                                                                                                                                                                                                                                                                                                                                                                                                              Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1552.001

                                                                                                                                                                                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                                                                                                                                                                                                              System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1614

                                                                                                                                                                                                                                                                                                                                                                                                                              System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1614.001

                                                                                                                                                                                                                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                                                                                                                                              T1005

                                                                                                                                                                                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                              background.png.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 911313a40fc97aafdaf9a1544605fa38e48402823fdfdad0dce33872ac8cf9b8
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              mgUc.txt
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\mgUc.txt
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 37d929b189f51d7c55575daa0c6d68c6553fbb0c9679acee29401c5388c8994f
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              KiIkscEo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\tmEcgksk\KiIkscEo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 cdc300ea0612ca070f879f1d03f6a46d8d59e72dde2d8057d7bfc8c0f540b1a8
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              bucIcUMI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\vIAMUgso\bucIcUMI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 220ee04870b9c33f42867a759363e759a307045f34c44428295cde742378a9e8
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              bucIcUMI.inf
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\vIAMUgso\bucIcUMI.inf
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 541f761f712c72d9e2d41352b173f501d966411d3d167e6717ebc600402a2f33
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              bucIcUMI.inf
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\vIAMUgso\bucIcUMI.inf
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 1b69cc5df73443b6fcf3175d68d5a7537f86ee1e730af80c6b9bfc43e2dd1836
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              96.png.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 6e41abde1a320bd3d17dea983818e27c2c0ec638a77b82817950f99c6723ad4e
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-08-04_20b286b7a74abcf9ce66ac8e0caa35ae_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 98817a572430813ca4ca2787dab20573f7864c5168ac6912f34d14b49e7bd7c9
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              VYAAgMoE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\VYAAgMoE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 112B
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 19B
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              hmEooIYM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\nqYUYoQU\hmEooIYM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 ddde77c747074ae5a52767cc01ca50cccf18122a85dd1e3ca8e945640d9f4938
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              hmEooIYM.inf
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\nqYUYoQU\hmEooIYM.inf
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 942f2152371dc9e9f421e2bcf9d8f960b205cd6c2150a581d5ecb318623d7db6
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              hmEooIYM.inf
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\nqYUYoQU\hmEooIYM.inf
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 bc8791235bef677e772d944ed279227b7877f9b721bcf6a887c05366534f79a2
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              hmEooIYM.inf
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\nqYUYoQU\hmEooIYM.inf
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 8869de8ada003713de4705dcc7cff422d521b29e95fd3d84bdb64fc97a1e2bdd
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              AEsa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\AEsa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 b6fd0439488907bf345ce1211fe7a66563edbd45bb04e38018843bca2a362c31
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              AIEe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\AIEe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 236cc738a2f1a59f39aec183a1b3fa03599eaeee6956e2f0146fa20c46fde8be
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              AMwK.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\AMwK.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 a8498ab8d54311d59b50997a7e6ef2f59b9c232e71221535f186fb86a09adecd
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              AQMw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\AQMw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 4f4ff6f55342640e4904cdc45f966834a6f2ed7b14318031c349188845479819
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              Acwu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Acwu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 f2403c7204458fb54f97d05004f41b91256fb2fdbffaf9d59fd4860b047db84e
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              AkIs.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\AkIs.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 9c9fd45790fe956176aeab743484780b62f28a6dcde6e85cb6c6279ff3323b16
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              Akkq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Akkq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 d4725877d1113b6ae1bde4144ef09b54b7f8857d76a862465df0bf2b1b98427f
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              CAAa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\CAAa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 207d6dab2a24f6982284ab9ab3213f3e8abdabce5bb33ef1bb6866a355392d26
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              CEMI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\CEMI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 0994c1676872468d6873194ba41a509ce8b0702c2c1ff00e684b4ce9866541c4
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              CIMU.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\CIMU.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 0b945cd858463198a2319799f721202efb88f1b7273bc3726206f0bb272802f7
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              CIQw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\CIQw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 46dd7940ec28883c65d9b56de2115fe6438125635e3679aa8b73c50852248c9a
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              CIYu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\CIYu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 bead46429e254b9fdb643a0fa8956b518cb685ebf4a47ebc2a79422f03d00b50
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              CMYa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\CMYa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 5164937758d37280c41d6adc6c27454090ca6f88bc42873af9cccf9fc5df5a1c
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              CQIy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\CQIy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 c3640e625f30b482b1e6c45509a36b47eb1697c74956179daa91cd2a31b79bb6
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              CYsA.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\CYsA.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              CcAy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\CcAy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 799d9b07a0335abee576ecee625e2829d3b5b024e2a25c9022edc79dc28dd992
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              CoQw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\CoQw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 943b1eb6d03d66844e08b59b62b9a70ebbfddb8416a2e2940e47ab8d175fc599
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              CugQ.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\CugQ.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              EAIo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\EAIo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 420a6e6c245613f9d0c67dae65a0614fdb30b10c4af7f072dae75c815fd781e7
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              EAgC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\EAgC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 5f3ba8b1ffdda4fc1c514ed90d0c5d76754d19bbfe32090b4bc3ed5a1452651c
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              EQYE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\EQYE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 5a2720a431245244d03ac4ab1677e40c3e7a20a08da46d9655bdd9e31cb14ea9
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              EUQC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\EUQC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 d10296b2fe5919ac97d0f6eea2c02fefea4b1eaf3b5345e8aee8858dbd066e7c
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              EcsQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\EcsQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 75e9e6f12f32331bfb1b9f8d8d54fe1bfff52462d279fd894fe72469bc21a689
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              GAkU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\GAkU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 b8a06f2e92763a057ad8f27106ab9526c2d4d933adf63d3cccb8db09b8819121
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              GEwY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\GEwY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 7a9f645a3aa4c764ee80c3d817978c34d42f243532a8affdf78f1a26487d0303
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              GIUG.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\GIUG.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 be541eea4d56544c9f51bd87b0c404fa0a6008aeac323705752543e48a31cc98
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              GcEo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\GcEo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 382bff4fb6d71767322a8640e6c1364c23d5475708cfda96fe87b5eca7f9bbf6
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              GkUw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\GkUw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 9640571592b5be56616f8147140d0dabbaa4ec726e607b063d37e2c1bd400dc2
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              GoAa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\GoAa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 b408df404597e41525f9072e602f3c9f282a636fa9ff91820fb1b554221c1154
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              GoEK.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\GoEK.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 a2ddf2c3e4f9e27e732d0d636804d77629baf98c2de10157daefb2a5ebe6c335
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              GoUe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\GoUe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 7b467d9ced82bc9c712702ca81eace3dd1e9ca3118064e647ceb8fcd5467e1ae
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              Gock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Gock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 29293612d11df7d15bd421363e6016a8252ae33bb3d7ec10c8c2b02262520373
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              GosM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\GosM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 1f736390112f0c6400733de26103cc4ac4b239296f9021f3eaa4b268a10e98d3
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              GuUE.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\GuUE.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 135efe6cdc9df0beb185988bd2d639db8a293dd89dcb7fc900e5ac839629c715
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              Gysg.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Gysg.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              IUcA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\IUcA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 852bcb98f3cb7fc9c2b5559413aa51b33271883ab5093742060c11e436f4672b
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              IYEw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\IYEw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 5cb631f2c7808362bb104f82eee13ed8187432cf811970670df22fcf19347ec9
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              IgUc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\IgUc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 77178cccde0cf095543b8b3d6e8a841dabe7113f4e5d9520eb0f90b9a99f75ac
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              IoIk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\IoIk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 a0642fb87a052afa45021be8ce86bc7e91cc9a1cced7f894f97af308ec589cd2
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              IokU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\IokU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 f4152d6ab3123c75445a22d8505437d52f8650f1c4711eb9e1c9b86ad0ab5253
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              Iwoi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Iwoi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 5a50aeda01cbc1408abd1fb6de5e7cef2c5c40e1a0fd6ac7f778096726940405
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              KAYu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\KAYu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 995b35cf46fa7aadfb2e569abc6ab42e30ccb397b536226fcd7ee9a29d5994e7
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              KIQy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\KIQy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 b0a0c8fc9855d16c1447d57b40e40a2a5e6b304d4d15b0fe5218c5891aca48d2
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              KMge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\KMge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 d2bacfcd745cc0fe1ab37125b7ac780fc8567a3c76ac06a83fc9218a933f1b19
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              KUMg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\KUMg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 ea5817818fe371071bddf320bd56030134cfa08195610f86de114b99c2e47387
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              KkIC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\KkIC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 fdf20b3f691026bb83eb89498241102ad341980dee084630febcd72dbc2fd5b8
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              KwUQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\KwUQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 a08f7174cf62cf39f56b60ad8a47428570801268dff4b575e099fc50384fa76d
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              Kwgi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Kwgi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 96cf31d90731e4e850e143b571b6c63b488f7212452716c0c9e6216d50a1456a
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              MAcO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\MAcO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 c055f9e197aafade01e3ae458c297e6dac68332fdec66ffb65c661d7be5b5720
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              MIMk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\MIMk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 b357555b823224843fd2e34fee838f07d28cd205c69edfc692347aef16f6831e
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              MQck.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\MQck.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 0cba0337e9ad79d966b5313758d95407f0ad99b609ac72ed71c74f36bf764c6d
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              MUIM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\MUIM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 e4e6ab2ae6bec57157e0c6844a071a9cac4be52567634d3b59a2067f45569b9b
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              MUoM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\MUoM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 315b92a7898a8ef537fef7c11726809dc353a5069c9a7295283b3e9a886fa365
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              MYwC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\MYwC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 c2818d1f9e0d9fb84f683e204eafa66315ced0617e78c8cca6c4857a4a3096e1
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              MakY.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\MakY.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              MkEe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\MkEe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 45879ca4bbe7650c7a0e5dfc48b502567cbe32a951782e9082f7e8098d9f5a51
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              OAcG.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\OAcG.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 dbbbaed3f6c107819124aa678181b6c00ce1a4658d254283d0f6ddce2af712b5
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              OAca.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\OAca.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 efde0919aa18a35f6959b02e1e1ae558dbc9520252e9b6992c97773e89970d6f
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              OEQM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\OEQM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 58c85ddaa52db3d002d21cb0c8a50682b6b35e079d931216a1412e2f36f97d0f
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              OIsO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\OIsO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 9e6094bd76c8051ec3c7fcc980699bc5ccb8c67f3c7348f6e9f2f1e114303873
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              OQUm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\OQUm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 5b7ea285259d6a3ddb585f8a63fcf966926822c01301d147e2928e88140cb5fb
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              OYks.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\OYks.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              Oogc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Oogc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 3.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 ea3f22687507133d7951f11e2e30fcade59c258a2096191d32edc1adad094192
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              OyUg.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\OyUg.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              QMUW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\QMUW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 7d18890a4a98412cecdf7e5e1e9296ce07e4f73d12440c4b0451d7946850b317
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              QQEI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\QQEI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 04463675dfe6acdbb26751b461fdd83e5a06f6cd7da727bb7c7abedac966c65d
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              Qcoc.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Qcoc.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 daa05353be57bb7c4de23a63af8aac3f0c45fba8c1b40acac53e33240fbc25cd
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              QgkG.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\QgkG.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 160b831caca845b2a1d9917a0ac0914940a77d0377d6d96c4e255cee0e5c56ff
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              QsMU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\QsMU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 7cad114b71c4fc4fd9a5b9700d0198f62d085d5ccfa1e1d95f0b7d4207b5a59e
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              SIYM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\SIYM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 0709f44f2a40bf71cc8134683d35ad6111d0d173a8494f8770ada8dba945d8e7
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              SIgi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\SIgi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 63df8fdea0204fa33215f32960edf9a67213c2ff42b29eb687b55a059fafdc1d
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              ScMs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\ScMs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 7475c91457b3e0b9d6d733ccb1403fa4b1a193b630294f7810096f7571f904a5
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              SwUa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\SwUa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 c19976bb709508ad7fe92da348485b434265cde5a3f6632bda1a797594ef7dfa
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              Swcu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Swcu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 8d03485694100252b35a43691e47d33863c7d4a247c630f21aeded5527e13fda
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              UQwC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\UQwC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 666747368fd2e360276e6e02f59f2eba286015a8daa8330e97609d62202e96a0
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              UYIu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\UYIu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 5cab975a7e1872623a0278826abd3826d9289b4b1f34d9b4d1c93046e576ebbd
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              WYIs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\WYIs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 f7cac1e9b6d1dcf29528364beedec1014ebf88b8345c7361c7d978232782f993
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              WYUm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\WYUm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 eaf864e1502845498b222103ad44bf4e2d68daa227608025208fab34c509e50c
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              WgUC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\WgUC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 37c117913978e413cdaf7856feab945334d9daf9d6769339db3937875fb14835
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              Wooc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Wooc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 6fe66c5651145fa6842ff02e56ddbe412e33b01cb02ea34082da86099e416027
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              WsYS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\WsYS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 7c70df5411c271063c2163a12ad2ad101b44dbbadf25c15cff3381acad1c5a15
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              WwMs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\WwMs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 6d348ba86dfeb045b61af9f096246ba4cb2db9bc68748529918b90844627311f
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              YAQY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\YAQY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 f307fe74e9668a9b2810b68d3d0cfa6926c58f2d1ea0a1828c7e7615b1773629
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              YIQS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\YIQS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 7fb1a52d9327c23437850427023ccf9b1eecd3f3c38f77c511c51cd95e273b77
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              YIUs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\YIUs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 6010e0660555f82b6f066bd0c906b287dccda25e33a4fb8b66202fae096b8de8
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              YMUg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\YMUg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 67aeddbba41bfd545ab0becb2d288da210e4ed80250c7ea84826655bfdc3cca8
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              YMwa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\YMwa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 6d7894ba1656169c881300a5a4a160fd9fe372fd1960c8c10beecca2e79c025e
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              YQEw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\YQEw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.7MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 992ea706df6bccf4e284f42511af86c4d6bd6c55ea6e5268f4a4a08bf462bffb
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              YUQE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\YUQE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 40db7d16d2915d6c4e9b1e52b4efa43529511a75a70ffc39394c8184136ed756
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              YYAa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\YYAa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 1eb634cd6b7a9634f3c41a92d599919ec5c441e62f684edf866277d251dbf51b
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              YcgW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\YcgW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 76bb504707541927e6780c6e6c581cb2d446d1756653e99acdd94d5cffc71f49
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              Ygcg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\Ygcg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 408e66dcf92b6b766890ef5247dbeb4feb5285242c3ffd79554e5207ed97c8f8
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              YsQO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\YsQO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 08c3374857205d0a24719a7f5329139bd11191c59b4cf34337f755a792aedd28
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              aUQq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\aUQq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 838a1ab9bc11b54c611c42ff17eda2191c0068f7aabf7b4a55e62936e57e2f57
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              aUgk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\aUgk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 2f3fbbe151bdec7d880e5941444fb4daeb5c777cb01e9e4edee7085aadbae526
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              aYQS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\aYQS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 26012832eba8ec609b1a0b32362f22fee23339558748cc8d0cb115f2c0d2413d
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              asAa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\asAa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 f2d0e766b59cab403d78cf54e0688e5787a7220021e24ffc42c03dd2ec883ddb
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              cEQg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\cEQg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 79ea60755cc9eb56214782bcd23eea3e2f9b417a5a48f3372de749098d9dc379
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              cEka.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\cEka.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 e1d96a3c68bca3c7e989323fd5a939a8a2b89970275f640cb773e86a6f929e29
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              cIgI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\cIgI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 06be9486150d3831a146944c382686be72b062682b431e78e9d81ffe607e3552
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              cMoa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\cMoa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 e99dfaa4af23d92d671559024e416eb24070af2f993b589d2c6f64653cced2d5
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              cgMs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\cgMs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 c9a4c940294c4685a5e5cacbe7eed435fced8cd09ebbae49e046d2f6ace349b7
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              cgQG.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\cgQG.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 3df2b1cb5a9e5bd1695e5a86243a3674bbce68b68a6c28b6d3670f9c0901c671
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              cwgm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\cwgm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 67e538fe78448aa20ec5bf7b80ab26a6e8ea409eeed76ea79b14af0b3a2a3428
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              eAAU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\eAAU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 9bed69fa6cd0b1075c4aadf6c22c9b1e7768d0be9f3f0b7b2e421846485bc2a8
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              eAAm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\eAAm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 998a8debc5749c047d39be86f69d3ff8f0fa7e08907b86b26cb19a3b000de8a8
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              eQUm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\eQUm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 54b9a807035eeb90ac117bcd8ff58f9fccf27f436e7cdf90f4d85b83f6ddd568
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              eYIU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\eYIU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 eeb4af03afdc99771bce98f9107d30b0c6eb7e8cac599c2bd613621becdb6abe
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              eooW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\eooW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 ac8a93621a18803a31b2004a6011ea30bf8f4e5be32fed5502975c90750ce4b4
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              gAQO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\gAQO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 7644b52d96f6953bb7497678624dd5bc9864724e1a9bbbe121b3c86a0cb5acad
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              gEES.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\gEES.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.7MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 8be4841fe05bd1aed9c162d705c38daa0966cc59debe13a63626eddfa59ade1e
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              gEUu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\gEUu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 462e7f10b1e0e42cbf254c8a07be9db2cf30897d428e2e740ddc360ba74a9ce8
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              gIIc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\gIIc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 9f4c8826cceac0a51d709c6d17dc57a9ebb0de41789bb7fa2555083917e58ec7
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              gMQW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\gMQW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 f45412a8707c8bd26fd3552b9d6df54c24cb20ea42dddefc55dca32644480978
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              gMwg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\gMwg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 4e6af513373aefec2d7234fdcbf82cf8a5d67ad047fa4117786d554143620b8d
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              gUMQ.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\gUMQ.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 57e72b9591e318a17feb74efa1262e9222814ad872437094734295700f669563
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              gYUW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\gYUW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 872b8e2a1cbe5c87aa81ec43edac11d5c87c313b76056d50d0adeff954d53a54
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              ggQi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\ggQi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 e9a5685f4b4c7241a01252bcd3433b423f0bc02f21d1c20733d115d6ff945251
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              ggUc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\ggUc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 7b9a9a468120b776b299db56334da0ad0a607ae47dd68e6632d86774f9acb885
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              ggYS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\ggYS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 377a5e1b9b27e9b705d0162e2b529852a4a8e0ad3dfa09a5b5d5939366d01c79
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              iEoU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\iEoU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 8743e18d899d9ca7cfcba8d3e96c28a29147e07d0361141445e79fea7ba0a42c
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              iEwe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\iEwe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 c2b8ea2eb53a0a516c3834c01631a3ef18931a17de73bfbc1dd53391f94fa6dc
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              iIka.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\iIka.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 fe218d93990686dddd4e3dd66e296b14233d8a74cc7559089da9c78403ccf924
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              iQEO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\iQEO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 cec055e1ad6d5309845662727b57d5d7352f5670fb1dbe18dc2e0ad93f3ed515
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              iQIK.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\iQIK.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 820fa0d86cb4297fd52ef0b126482082f3c98b2b1ed176cdada164153023a508
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              iccq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\iccq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 293d39bf3efed138e5275bf79f05cc4e92fb836e962d44db5898f5744fa86215
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              icsA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\icsA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 d88acd10d3140714f3fb774d2f90d7dae71119a2246346ca11eb3d491a7ba218
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              igQA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\igQA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 e6aa49f858e80638a04e1026766bb5c2821612dc62f89fb93a183f49564b1fd1
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              igYk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\igYk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 98fdd846e59155f57d3d171bd767b46ccd2e88d517f4a04d20eccea7ef009a5e
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              isUW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\isUW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 2fa2cd917b4249c4c1caa7a846f7a52157edcfb60ba63fb6942fc334a925ddc0
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              iyUg.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\iyUg.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              kAoo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\kAoo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 08dc7d738636a948af34bd2621af094b6cb11dfb62350dcd17157b3bd9d53bb9
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              kEow.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\kEow.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 457f421090f4d18dee3cc72e27246ca3b6844c64eb82b0a748e3cf15fe4ffcfd
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              kIom.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\kIom.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 90a7aac6293eaecc1ad9cdf81cec04716665a40aa11a586d47845aed19b4919d
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              kQss.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\kQss.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              kUgc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\kUgc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 640fc44a3b43c65212c0becd61b65dbe61b221f522951e0cbe4a3fa159a4d889
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              kckE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\kckE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 911dd67a4a44baed4c397089310834159dcdf7dcf4c27b12b1af4d185e05cf4c
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              kgQk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\kgQk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 37587256668188a3f1873b4f61b5b0cfe415679d64ea5cf3aae1d317229e74e3
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              kooE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\kooE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 0860023d6e83d55177b919f08ead8b432bd8f557b5b8cc43091e8780dc506c52
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              mMEw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\mMEw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 662c6332cf451ddcab9265af36178be93070dbf9ce0a4fb88243ea62de80512e
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              mMoo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\mMoo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 67f0c90631dbb08861e06b02b1541735d6de344f0210ac8bc43a5ae98398d405
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              mQcM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\mQcM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 fac7732ab447f400563a937377144087c0034831b0d41d238e71b0051582296c
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              mSog.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\mSog.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              mUwc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\mUwc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 3b1c65acdcb24fa5b69e25af8925c34e3b45b210b65f8498877ff9a2d1ed96e2
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              mYgm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\mYgm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 657b7244e51bd88b2d8dcf8e6728ebdc23ea40c286de63580be1be680a6bdd35
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              mowa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\mowa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 65cc36ee11221375261645906a3a0ff0282dccc5847d78b345bf7c591840e85c
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              mwYg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\mwYg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 2d66aee9b432e67d1404668cbc83937992c1bbb306ded5f32d8b4f990485c1fb
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              oAIW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\oAIW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 87f07f387bce7452da8a37aa98f2d14d2f45ecf84f0cb96e1646662b9b168ab4
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              oAcU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\oAcU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 2ef42c4993c31bf36cdc767276e84ce5ded1417782e3352bdbaca7eb7cfae56a
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              oQEI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\oQEI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 a7f64d4d27308252d7c28911e008b1559ba856529786e900a453d93d2cc23c0c
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              oQoy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\oQoy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 afcabbb17d9567168a18e722abc7d8849e25e9ac21908de4f2366d810b9bd9e7
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              oicg.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\oicg.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 be3e79875f3e84bab8ed51f6028b198f5e8472c60dcedf757af2e1bdf2aa5742
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              osEk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\osEk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 887764c45fe6184c2545a68b8093e95a925d47c4350a6b7aa7bd6d1a1ecaae34
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              osMQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\osMQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 8d68fd59581bc6e0cdaa2709498d5ec33c2e2987134ff327bad4d6aa09780eff
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              oscG.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\oscG.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 13f778029614e7adac50c2697ecb4b142fe6ac3183ac6304d866ffc0d2139212
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              qQEu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\qQEu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 30987fd70850d33f80521bbbce9d5153c4a1a7e3d1f84e2fdcf1bcab01c280af
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              qYoI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\qYoI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 b77315ab0fb5cb40ac62b7a4dda260afdd49f2d536e14db5913c97b8543c2ea7
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              qkcA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\qkcA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 4a50a0cac6acdbd12f853be653cbc33158402d2526b62c12d6b253be57bc0f6a
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              qoMY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\qoMY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 80d32e37b37ee13a54039521f7ab1f259aeb78e1a4ac8436d49437bc74e4a8c6
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              qwIq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\qwIq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 5d404557a72e95003ce9d2709b1554fc09a56111afe48375c591b2f23316de52
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              qwsW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\qwsW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 b8117c46ba782b58104565ce6cd71fc376594a2900d796a5d45a7925e80e0435
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              sEoK.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\sEoK.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 a43bf3dcfa2de9f6831b46dd2eb86fb3a30a31dced798a88859dd9f8574cfd65
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              sMEO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\sMEO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 02b11b6b4ac8966aa536f2b90c3488396682648ab8335a278a86b19417debf69
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              sMIO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\sMIO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 58f892de38eb35383af0b7f664ee2436a7962bd2c45c67772416da3f2ff8dd41
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              sMMo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\sMMo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 aed82cb628c24822e266fd71fce183b5f1e2afb5ae07b4efba8bbef5fade02aa
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              sUME.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\sUME.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 75d09e535077aeafcc7e6ec76de85a88adb4e9835f4fa2add6922ac632200a99
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              scEm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\scEm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 f3354b1cc7bb69586415edf54b8db4760cf3e5f1c8070b38b06254fa81862140
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              skIM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\skIM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 8cc09035a7b9a31354c32d930ace47509818ebd607fbb9dd51a9f93717906ccb
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              swQq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\swQq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 d06589bcf7d9d76f5b3057ea405a9b14c307dbf3fc27415b4eda59312c675d6c
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              swkQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\swkQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 891025a8c3a15af41eef84b9ebe089b1e8a9346c962953acfd53aa5053c2fdc9
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              uAUi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\uAUi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 afa065194414bfe452c5684dbb9b15f758ae91c725ca289a33da6befdbd41538
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              uAgu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\uAgu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 288cd37f2a8fe691d82cef64bf475a0d852f8ee155f9154f5abc6188a2b7cec5
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              uEcG.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\uEcG.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 434a0e226b252fddba6b7fcdfa6e1aa5e710209fd6aa496a97ac943a8401e11d
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              uMkY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\uMkY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 b4f84fb0cc05670af7b39ad1abd72f6b030c3d787c6f467da8de884e756cf33b
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              uUog.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\uUog.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 e812e07e7335d0a2f53b154361af696707be6d0ac7f71f0a6c60bb4fe705ba1d
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              ucMo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\ucMo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 d82366b28408a233aefd28ac15c92666648aa5bfe9c3c11b681fea05c401349b
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              ugUm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\ugUm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 d49f4da2e35a364e08492feb9a94d945c4b6e63dc5deb904a91a98dda88f6481
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              ugcm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\ugcm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 17116ed7306e3592d513df38829e4d9bb5ddd262c62aab2863ce6d9f3a871321
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              uiEI.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\uiEI.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              ukEK.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\ukEK.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 178fb9f903a2e8bae77c7c4c68fea5b5f6d08f73c508510250c597e5037c75e6
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              uoEq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\uoEq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 7bf5491f471cc9ecbb067f2a47ce77c26a8bd1994dd29241bc2446bd75e8f429
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              uoYA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\uoYA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 b0abef13fecc8a745b01f9f17dc75db46400a52f4a8d0b1203674a951c10a357
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              wAUa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\wAUa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 141cbcd2d8cd1f6fb2ce2f49a554c06e59f1003da612f3d253f1cb3715e877f7
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              wQcG.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\wQcG.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 4cb41c05f9a5b65844f355247fc0ed6cad5003d29784f60e58b0067cf6524092
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              wUYe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\wUYe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 53fa6e68243a4ec2c6f2646040007b9d14a84f2265a5e589f54dae1cf8d37bc1
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              wUoq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\wUoq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 bcd404f9cebacf76b880735708f35fea11f8d711977b6a9400d1c5e16209f7f6
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              wgcm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\wgcm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 2e82e483cf0c7dc69b1a55c356a44eb12b4822076228079f3f5d006211c5f247
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              wkgE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\wkgE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 b9d84ca868b1db7e38f7f48316ab385a94141b1522a2b2215228e07d8f6b58e7
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              wmkw.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\wmkw.ico
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 1aa540b0acfa68f313963ae32ca68a5b3cefb49217cbf3b9e0b9eb98b9b94b6a
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              wsMO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\wsMO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 532c559bf961ef342c429984f03588af549a3a7f8d9f57a2e40bab6668585955
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              wwka.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\wwka.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 ac0bfbaa062877443f0d8c75f33bb72fcfa3d96419f20122072de26062e61830
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              wwos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\wwos.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 127f91e9f52c5736e947018cd4578022267a0956023b3a997451b3b8c5b538a0
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              yAQy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\yAQy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 860f6476188b9ebc869049af6b00ceeb7b8f12188ee343707aba16ecc6faccaa
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              yIgU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\yIgU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 c101e62c9214eeaba0ff0288d0c439afaf00a7d363fde214952460ef608652b9
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              yMQA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\yMQA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 5b7293d18788ab648ebd7280c343367b4e6e0e3ced85557a30846568aea2f2ed
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              yQgk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\yQgk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 965f5771553045d0320bfa0fd587a96018073bcb78d6639788dd4cce00f97239
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              yQwW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\yQwW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 7333468fbba46559c7096825d47043d7ad8377e6589c398af1dffbf313328485
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              yUcA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\yUcA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 420cd38a54bee11c54c8bb216046dc55f894612ee994a729bf317f73ae81eaab
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              yYko.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\yYko.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 937ab3140fd946fc7e150829ca28e1c9d15e4f312c3575dbac3633c224ad2da3
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              yYsy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\yYsy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 8ef4eaf4d424a3497acf2a4af6cba17e448609f37d6bac496bf0100fd4517887
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              yccA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\yccA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 2c498a628fb49e26cc28867158c86c17d9458fbdd839c53783d8eeb1c7be9bc0
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              ykEe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\ykEe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 62d39e33e551a5e7efa6f90d726c7f705e85367cd7fd64b38406aec654fe2328
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              ysYi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\ysYi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 f3f76a406ebe8029a48897055e77110997221578dc1f62b34966a4fa736d8f0a
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              ysYm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Path C:\Windows\SysWOW64\ysYm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                              • SHA256 0d14cfca0d5d57e6241ece450cb6911f5d48e1f70f3fa83e84447e93a228a5ec
                                                                                                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/700-2752-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/720-204-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/720-212-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/988-1065-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/988-948-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/1184-32-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/1408-727-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/1436-49-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/1436-64-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/1440-71-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/1440-59-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/1664-119-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/1668-34-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/1864-523-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/1864-458-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/2036-17-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/2180-2775-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/2180-2765-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/2484-30-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/2484-48-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/2504-2869-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/2504-2876-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/2696-221-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/2696-245-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/3048-173-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/3048-160-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/3080-2881-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/3080-2892-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/3592-104-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/3592-87-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/3776-2715-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/3804-2712-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/3804-2726-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/3924-18-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/3992-149-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/3992-159-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/3996-205-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/3996-193-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4120-120-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4120-134-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4128-2740-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4152-175-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4152-190-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4220-340-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4220-426-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4296-298-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4296-354-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4316-529-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4316-584-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4432-214-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4432-233-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4436-917-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4460-761-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4460-835-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4528-2889-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4628-6-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4636-2856-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4684-2679-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4684-2691-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4792-90-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4792-76-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4856-1068-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4856-2672-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4868-2830-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4868-2819-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4872-27-0x00000000006D0000-0x00000000006F0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4872-0-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4872-1-0x00000000006D0000-0x00000000006F0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/4872-26-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5048-145-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5048-130-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5168-2802-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5168-2814-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5180-2794-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5180-2784-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5232-2700-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5232-2692-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5268-2827-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5268-2842-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5368-2863-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5424-2757-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5424-2768-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5512-2697-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5512-2707-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5564-2801-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5648-2733-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5652-2849-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5652-2835-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5660-2760-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5660-2749-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5856-2822-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5856-2811-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5880-2787-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5896-2680-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5964-2884-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                                                                                              memory/5964-2873-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                              Download