Overview

overview

10

Static

static

3

2026-08-06...ck.exe

windows10-2004-x64

10

2026-08-06...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 18:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
  • Size 1.6MB
  • Sample260806-wr8easgl3s
  • SHA256 a0d83735d86612796d4b3f13c32a872c39cb8d901e61dfc66657a2ce2751485b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 34 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 34 IoCs
    defense_evasiontrojan
  • Renames multiple (94) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 34 IoCs
    execution
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3444
    • C:\Users\Admin\vqUgEssQ\lmcQMAsw.exe
      "C:\Users\Admin\vqUgEssQ\lmcQMAsw.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4056
    • C:\ProgramData\kwcwQUEY\aKIoIkwc.exe
      "C:\ProgramData\kwcwQUEY\aKIoIkwc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4964
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4864
      • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4956
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1496
          • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1840
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5996
              • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1880
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4980
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4060
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2004
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3176
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5060
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:1164
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:3008
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:5140
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3596
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:1140
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2712
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1240
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          PID:4372
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5504
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                              22⤵
                                              • Executes a command shell one-liner
                                              PID:2416
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                23⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:5660
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  PID:3600
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                    25⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:1280
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      PID:2520
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                        27⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5100
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          PID:4232
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                            29⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:5540
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              PID:3676
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                31⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1500
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2384
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                    33⤵
                                                                      PID:2052
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                        34⤵
                                                                        • Executes a command shell one-liner
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5124
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                          35⤵
                                                                            PID:3528
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                              36⤵
                                                                              • Executes a command shell one-liner
                                                                              PID:1548
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                37⤵
                                                                                  PID:6028
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                                    38⤵
                                                                                    • Executes a command shell one-liner
                                                                                    PID:3168
                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                      39⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3316
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                                        40⤵
                                                                                        • Executes a command shell one-liner
                                                                                        PID:1844
                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                          41⤵
                                                                                            PID:5932
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                                              42⤵
                                                                                              • Executes a command shell one-liner
                                                                                              PID:3492
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                                43⤵
                                                                                                  PID:4360
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                                                    44⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:4260
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                                      45⤵
                                                                                                        PID:3192
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                                                          46⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          PID:912
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                                            47⤵
                                                                                                              PID:4736
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                                                                48⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:3728
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                                                  49⤵
                                                                                                                    PID:1072
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                                                                      50⤵
                                                                                                                        PID:5844
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                                                          51⤵
                                                                                                                            PID:4636
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                                                                              52⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:252
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                                                                53⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:1864
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                                                                                  54⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:1736
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                                                                    55⤵
                                                                                                                                      PID:5572
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                                                                                        56⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:2516
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                                                                          57⤵
                                                                                                                                            PID:3640
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                                                                                              58⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:4032
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                                                                                59⤵
                                                                                                                                                  PID:3736
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                                                                                                    60⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:4100
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                                                                                      61⤵
                                                                                                                                                        PID:5860
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                                                                                                          62⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:1268
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                                                                                            63⤵
                                                                                                                                                              PID:3844
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                                                                                                                64⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:1316
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                                                                                                  65⤵
                                                                                                                                                                    PID:2764
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                                                                                                                      66⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:1432
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                                                                                                        67⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:2528
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock"
                                                                                                                                                                          68⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:4328
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                          68⤵
                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:4792
                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                            69⤵
                                                                                                                                                                              PID:5368
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                            68⤵
                                                                                                                                                                              PID:4384
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                              68⤵
                                                                                                                                                                              • UAC bypass
                                                                                                                                                                              PID:3292
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VaUgMMUg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                                                              68⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:4632
                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                69⤵
                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:5880
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                          66⤵
                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                          PID:1180
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                          66⤵
                                                                                                                                                                            PID:3576
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                            66⤵
                                                                                                                                                                            • UAC bypass
                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                            PID:480
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oSEoMsck.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                                                            66⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:2876
                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                              67⤵
                                                                                                                                                                                PID:2476
                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                67⤵
                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                PID:1340
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                          64⤵
                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:3248
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                          64⤵
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:4428
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                          64⤵
                                                                                                                                                                          • UAC bypass
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:5164
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VaIIEkMI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                                                          64⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:2100
                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                            65⤵
                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                            PID:2984
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                      62⤵
                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                      PID:4680
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                      62⤵
                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                      PID:4792
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                      62⤵
                                                                                                                                                                      • UAC bypass
                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                      PID:3988
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iMoIcIMo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                                                      62⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:6068
                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                        63⤵
                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:5620
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                  60⤵
                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:4376
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                  60⤵
                                                                                                                                                                    PID:5756
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                    60⤵
                                                                                                                                                                    • UAC bypass
                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                    PID:4796
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zMgwQUwk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                                                    60⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:3140
                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                      61⤵
                                                                                                                                                                        PID:3868
                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                        61⤵
                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                        PID:1436
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                  58⤵
                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                  PID:4468
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                  58⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:2100
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                  58⤵
                                                                                                                                                                  • UAC bypass
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:612
                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    59⤵
                                                                                                                                                                      PID:4072
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AuwkEEsA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                                                    58⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:1248
                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                      59⤵
                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                      PID:4740
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                56⤵
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                • Modifies registry key
                                                                                                                                                                PID:6008
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                56⤵
                                                                                                                                                                • Modifies registry key
                                                                                                                                                                PID:6076
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                56⤵
                                                                                                                                                                • UAC bypass
                                                                                                                                                                PID:4632
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TCQQgQAg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                                                56⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:940
                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                  57⤵
                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:4584
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                            54⤵
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            • Modifies registry key
                                                                                                                                                            PID:1136
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                            54⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            • Modifies registry key
                                                                                                                                                            PID:2120
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                            54⤵
                                                                                                                                                            • UAC bypass
                                                                                                                                                            PID:1752
                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                              55⤵
                                                                                                                                                                PID:3564
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oqoQQIYU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                                              54⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:1800
                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                55⤵
                                                                                                                                                                  PID:892
                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                  55⤵
                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:3012
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                            52⤵
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            • Modifies registry key
                                                                                                                                                            PID:5128
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                            52⤵
                                                                                                                                                            • Modifies registry key
                                                                                                                                                            PID:4804
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                            52⤵
                                                                                                                                                            • UAC bypass
                                                                                                                                                            PID:716
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ByUYAYMI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                                            52⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:4592
                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                              53⤵
                                                                                                                                                                PID:2664
                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                53⤵
                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:1308
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                          50⤵
                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                          PID:5768
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                          50⤵
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:4780
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                          50⤵
                                                                                                                                                          • UAC bypass
                                                                                                                                                          PID:5788
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jicoogIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                                          50⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:1008
                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                            51⤵
                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                            PID:3512
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                      48⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:3868
                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                        49⤵
                                                                                                                                                          PID:3348
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                        48⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        • Modifies registry key
                                                                                                                                                        PID:4904
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                        48⤵
                                                                                                                                                        • UAC bypass
                                                                                                                                                        • Modifies registry key
                                                                                                                                                        PID:5368
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MwIcEoko.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                                        48⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:3320
                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                          49⤵
                                                                                                                                                            PID:3740
                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                            49⤵
                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                            PID:1592
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                      46⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:2372
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                      46⤵
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:5772
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                      46⤵
                                                                                                                                                      • UAC bypass
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:3644
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cyAUkEEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                                      46⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:4332
                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                        47⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        PID:4796
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                  44⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  PID:2360
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                  44⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:4072
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                  44⤵
                                                                                                                                                  • UAC bypass
                                                                                                                                                  PID:1136
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YqwUQUQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                                  44⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:1520
                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                    45⤵
                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                    PID:3564
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                              42⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:1804
                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                43⤵
                                                                                                                                                  PID:6024
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                42⤵
                                                                                                                                                  PID:4776
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                  42⤵
                                                                                                                                                  • UAC bypass
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:3516
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HqwQAEEk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                                  42⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:2724
                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                    43⤵
                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1828
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                              40⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:2728
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                              40⤵
                                                                                                                                                PID:480
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                40⤵
                                                                                                                                                • UAC bypass
                                                                                                                                                • Modifies registry key
                                                                                                                                                PID:5392
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JcQosEwk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                                40⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:5744
                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  41⤵
                                                                                                                                                    PID:1632
                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                    41⤵
                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                    PID:2036
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                              38⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:6020
                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                39⤵
                                                                                                                                                  PID:5724
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                38⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Modifies registry key
                                                                                                                                                PID:3292
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                38⤵
                                                                                                                                                • UAC bypass
                                                                                                                                                • Modifies registry key
                                                                                                                                                PID:1008
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rqgwAIQc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                                38⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:4400
                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                  39⤵
                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                  PID:2664
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                            36⤵
                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Modifies registry key
                                                                                                                                            PID:5340
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                            36⤵
                                                                                                                                              PID:3512
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                              36⤵
                                                                                                                                              • UAC bypass
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:3740
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qaggYYIU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                              36⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:1172
                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                37⤵
                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                PID:1456
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                          34⤵
                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Modifies registry key
                                                                                                                                          PID:1904
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                          34⤵
                                                                                                                                            PID:5544
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                            34⤵
                                                                                                                                            • UAC bypass
                                                                                                                                            PID:2304
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aEMQogoY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                            34⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:5868
                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                              35⤵
                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1100
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                        32⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:4144
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                        32⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2024
                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          33⤵
                                                                                                                                            PID:4876
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                          32⤵
                                                                                                                                          • UAC bypass
                                                                                                                                          PID:892
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YmAwYwUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                          32⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:5136
                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                            33⤵
                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                            PID:988
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                      30⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:6024
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                      30⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:4764
                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        31⤵
                                                                                                                                          PID:3552
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                        30⤵
                                                                                                                                        • UAC bypass
                                                                                                                                        PID:2476
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JqMUMokg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                        30⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:3720
                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          31⤵
                                                                                                                                            PID:1528
                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                            31⤵
                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                            PID:3012
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                      28⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:4276
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                      28⤵
                                                                                                                                        PID:1632
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                        28⤵
                                                                                                                                        • UAC bypass
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:1608
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jsgcQwYs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                        28⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:1092
                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          29⤵
                                                                                                                                            PID:3672
                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                            29⤵
                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5440
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                      26⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:2300
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                      26⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:6008
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                      26⤵
                                                                                                                                      • UAC bypass
                                                                                                                                      PID:5480
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zWogMYcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                      26⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:5252
                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                        27⤵
                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                        PID:3088
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                  24⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:5204
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                  24⤵
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:1524
                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                    25⤵
                                                                                                                                      PID:4308
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                    24⤵
                                                                                                                                    • UAC bypass
                                                                                                                                    PID:3348
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CuMgMMEI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                    24⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:3200
                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                      25⤵
                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                      PID:4804
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                22⤵
                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Modifies registry key
                                                                                                                                PID:4840
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                22⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Modifies registry key
                                                                                                                                PID:1656
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                22⤵
                                                                                                                                • UAC bypass
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Modifies registry key
                                                                                                                                PID:5248
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qcMYAEgQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                                22⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:5864
                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                  23⤵
                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4796
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                            20⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            • Modifies registry key
                                                                                                                            PID:944
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                            20⤵
                                                                                                                              PID:4144
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                              20⤵
                                                                                                                              • UAC bypass
                                                                                                                              PID:1520
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oswwAIso.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                              20⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2860
                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                21⤵
                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                PID:5676
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                          18⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:1528
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                          18⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:2724
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                          18⤵
                                                                                                                          • UAC bypass
                                                                                                                          • Modifies registry key
                                                                                                                          PID:6088
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dMQIEAwk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                          18⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:8
                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                            19⤵
                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:4872
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                      16⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Modifies registry key
                                                                                                                      PID:2640
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                      16⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Modifies registry key
                                                                                                                      PID:5576
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                      16⤵
                                                                                                                      • UAC bypass
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:2728
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TskgMUws.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                      16⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:6120
                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                        17⤵
                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                        PID:916
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                  14⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  • Modifies registry key
                                                                                                                  PID:1864
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                  14⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Modifies registry key
                                                                                                                  PID:2996
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                  14⤵
                                                                                                                  • UAC bypass
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:3292
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nKoIwssA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                  14⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:248
                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                    15⤵
                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                    PID:1324
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                              12⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              • Modifies registry key
                                                                                                              PID:4308
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                              12⤵
                                                                                                                PID:5384
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                12⤵
                                                                                                                • UAC bypass
                                                                                                                • Modifies registry key
                                                                                                                PID:3140
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aGQUAAkM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                                12⤵
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4828
                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                  13⤵
                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:1400
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                            10⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Modifies registry key
                                                                                                            PID:2228
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                            10⤵
                                                                                                            • Modifies registry key
                                                                                                            PID:6068
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                            10⤵
                                                                                                            • UAC bypass
                                                                                                            PID:3188
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yeQkcAgU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                            10⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3436
                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                              11⤵
                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                              PID:5724
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                        8⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • Modifies registry key
                                                                                                        PID:5772
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                        8⤵
                                                                                                        • Modifies registry key
                                                                                                        PID:4876
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                        8⤵
                                                                                                        • UAC bypass
                                                                                                        • Modifies registry key
                                                                                                        PID:912
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AssYgQUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                        8⤵
                                                                                                        • Executes a command shell one-liner
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1332
                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                          9⤵
                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                          PID:1396
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                    6⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    PID:3552
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                    6⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Modifies registry key
                                                                                                    PID:3704
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                    6⤵
                                                                                                    • UAC bypass
                                                                                                    • Modifies registry key
                                                                                                    PID:2968
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RgUcIoUE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                    6⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2128
                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                      7⤵
                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:3500
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                4⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Modifies registry key
                                                                                                PID:3672
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                4⤵
                                                                                                • Modifies registry key
                                                                                                PID:1140
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                4⤵
                                                                                                • UAC bypass
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Modifies registry key
                                                                                                PID:4428
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZAgQIcsg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                                4⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2676
                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                  5⤵
                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:4596
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                            2⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Modifies registry key
                                                                                            PID:1976
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2176
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                            2⤵
                                                                                            • UAC bypass
                                                                                            PID:4848
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gGwMEIQc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock.exe""
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:256
                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                              3⤵
                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                              PID:472
                                                                                        • C:\ProgramData\SOQAQoYQ\TEEgQUgQ.exe
                                                                                          C:\ProgramData\SOQAQoYQ\TEEgQUgQ.exe
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          • Drops file in System32 directory
                                                                                          PID:1628
                                                                                        • C:\ProgramData\kwcwQUEY\aKIoIkwc.exe
                                                                                          C:\ProgramData\kwcwQUEY\aKIoIkwc.exe
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          PID:5828
                                                                                        • C:\Users\Admin\vqUgEssQ\lmcQMAsw.exe
                                                                                          C:\Users\Admin\vqUgEssQ\lmcQMAsw.exe
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          • Drops file in Windows directory
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          PID:5436
                                                                                        • C:\Windows\System32\sihclient.exe
                                                                                          C:\Windows\System32\sihclient.exe /cv i/VVPmICbUuJ0s18sHMAow.0.2
                                                                                          1⤵
                                                                                            PID:5204

                                                                                          Network

                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                Reconnaissance

                                                                                                Resource Development

                                                                                                Initial Access

                                                                                                Execution

                                                                                                Command and Scripting Interpreter

                                                                                                2
                                                                                                T1059

                                                                                                Visual Basic

                                                                                                1
                                                                                                T1059.005

                                                                                                Windows Command Shell

                                                                                                1
                                                                                                T1059.003

                                                                                                Persistence

                                                                                                Boot or Logon Autostart Execution

                                                                                                1
                                                                                                T1547

                                                                                                Registry Run Keys / Startup Folder

                                                                                                1
                                                                                                T1547.001

                                                                                                Privilege Escalation

                                                                                                Abuse Elevation Control Mechanism

                                                                                                1
                                                                                                T1548

                                                                                                Bypass User Account Control

                                                                                                1
                                                                                                T1548.002

                                                                                                Boot or Logon Autostart Execution

                                                                                                1
                                                                                                T1547

                                                                                                Registry Run Keys / Startup Folder

                                                                                                1
                                                                                                T1547.001

                                                                                                Defense Evasion

                                                                                                Abuse Elevation Control Mechanism

                                                                                                1
                                                                                                T1548

                                                                                                Bypass User Account Control

                                                                                                1
                                                                                                T1548.002

                                                                                                Hide Artifacts

                                                                                                1
                                                                                                T1564

                                                                                                Hidden Files and Directories

                                                                                                1
                                                                                                T1564.001

                                                                                                Impair Defenses

                                                                                                1
                                                                                                T1562

                                                                                                Disable or Modify Tools

                                                                                                1
                                                                                                T1562.001

                                                                                                Modify Registry

                                                                                                4
                                                                                                T1112

                                                                                                Credential Access

                                                                                                Credentials from Password Stores

                                                                                                1
                                                                                                T1555

                                                                                                Credentials from Web Browsers

                                                                                                1
                                                                                                T1555.003

                                                                                                Unsecured Credentials

                                                                                                1
                                                                                                T1552

                                                                                                Credentials In Files

                                                                                                1
                                                                                                T1552.001

                                                                                                Discovery

                                                                                                System Information Discovery

                                                                                                1
                                                                                                T1082

                                                                                                System Location Discovery

                                                                                                1
                                                                                                T1614

                                                                                                System Language Discovery

                                                                                                1
                                                                                                T1614.001

                                                                                                Lateral Movement

                                                                                                Collection

                                                                                                Data from Local System

                                                                                                1
                                                                                                T1005

                                                                                                Command and Control

                                                                                                Exfiltration

                                                                                                Impact

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                QQIQ.txt
                                                                                                • Path C:\ProgramData\QQIQ.txt
                                                                                                • Size 9KB
                                                                                                • SHA256 cdba811bb5ef7f92177cccf22e3f2ce57adc052d1371d7eb49a60c20815e0964
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                TEEgQUgQ.exe
                                                                                                • Path C:\ProgramData\SOQAQoYQ\TEEgQUgQ.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 c32d245c18a63f3b4cf10d49869589cd8f056bbb4d0e9f1fb74009a40d192cf6
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                aKIoIkwc.exe
                                                                                                • Path C:\ProgramData\kwcwQUEY\aKIoIkwc.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 342cfc449559a9273551ccb2f1be14086292ea21516aa9d677a8865a099b8caf
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                aKIoIkwc.inf
                                                                                                • Path C:\ProgramData\kwcwQUEY\aKIoIkwc.inf
                                                                                                • Size 4B
                                                                                                • SHA256 07865062db0462f35aa9327dfc96ac976500e22593f44f12fbe8d5353373131d
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                aKIoIkwc.inf
                                                                                                • Path C:\ProgramData\kwcwQUEY\aKIoIkwc.inf
                                                                                                • Size 4B
                                                                                                • SHA256 8feefa75fb04e32c7329b1a258bafabec903bc7936a336c226a74bc21b56f070
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                aKIoIkwc.inf
                                                                                                • Path C:\ProgramData\kwcwQUEY\aKIoIkwc.inf
                                                                                                • Size 4B
                                                                                                • SHA256 e8fe2d08700118840c5bbf43654240fb8bf90ff51b1cad6e82fe77a410581a83
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                aKIoIkwc.inf
                                                                                                • Path C:\ProgramData\kwcwQUEY\aKIoIkwc.inf
                                                                                                • Size 4B
                                                                                                • SHA256 483d730fe7f73b957da0ee78c74b77ca05f4748c73d159469d2edf7bd04341c2
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-08-06_3bfee97b54341eeaa0f3c9cb7ebe1120_elex_virlock
                                                                                                • Size 38KB
                                                                                                • SHA256 0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                file.vbs
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                • Size 19B
                                                                                                • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                gGwMEIQc.bat
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\gGwMEIQc.bat
                                                                                                • Size 112B
                                                                                                • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                lmcQMAsw.exe
                                                                                                • Path C:\Users\Admin\vqUgEssQ\lmcQMAsw.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 4916f0f5f26a4c5623d8f18ac28c56bd63df0645ee42bc54d54146c8c4b4f45b
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                lmcQMAsw.inf
                                                                                                • Path C:\Users\Admin\vqUgEssQ\lmcQMAsw.inf
                                                                                                • Size 4B
                                                                                                • SHA256 79c1a0bca76051a84a2b0f8da7ba0eb3d69e5c3dc14687a62615b8ad5773d559
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                AIAa.exe
                                                                                                • Path C:\Windows\AIAa.exe
                                                                                                • Size 3.1MB
                                                                                                • SHA256 69b52ddeecfab4bf5825820c73e0532a3bed723c4bcd9276190f8cafc50c7602
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                AIIE.exe
                                                                                                • Path C:\Windows\AIIE.exe
                                                                                                • Size 2.1MB
                                                                                                • SHA256 7657dcbe47405e91904383368e6909f78234e18c96ae04a0310ee2247335c3db
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                AIwQ.exe
                                                                                                • Path C:\Windows\AIwQ.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 66ca1b2f2064928834ebec1bd908fc5c8bce4e1b4dafbddc73401eb2f5bb03cb
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                AUAe.exe
                                                                                                • Path C:\Windows\AUAe.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 f29c9972864666cf8f7113e079d19de02ed388c8aa8c817f09af37971cb3f275
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                AgsW.exe
                                                                                                • Path C:\Windows\AgsW.exe
                                                                                                • Size 1.7MB
                                                                                                • SHA256 fc59b2d64a2dd6df9d2cf094b06ea66ce209627a24684bfb243453d72758de7a
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                AoAW.exe
                                                                                                • Path C:\Windows\AoAW.exe
                                                                                                • Size 2.0MB
                                                                                                • SHA256 e316e402cc2d1981c0632c6cab073ee1b3ff5ab86aaf76990708f51fc04b65e3
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                AssQ.exe
                                                                                                • Path C:\Windows\AssQ.exe
                                                                                                • Size 2.0MB
                                                                                                • SHA256 2a154a778fdad70bafaabb412bc26d3c12a79ea842beb91e8d9b57b53d82cd52
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                AwYA.exe
                                                                                                • Path C:\Windows\AwYA.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 d256f27b765e715863b7e2d16c2ff3026483bfbe749368c745bb92c07cd53d97
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                AwsQ.exe
                                                                                                • Path C:\Windows\AwsQ.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 aae4a08018ff9677e0b80c7edd195344177fbd88059e80fc02d7d87856ee2053
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                CMUE.exe
                                                                                                • Path C:\Windows\CMUE.exe
                                                                                                • Size 2.1MB
                                                                                                • SHA256 eedc829958cee20b035f54e4393a19a326ed4919651af44caf73864271a7185f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                EIoc.exe
                                                                                                • Path C:\Windows\EIoc.exe
                                                                                                • Size 1.8MB
                                                                                                • SHA256 8353399477b5d1e59bb00d07d546f8a67d6de07b5d2e6b923f1e54c0314720a6
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                EQQe.exe
                                                                                                • Path C:\Windows\EQQe.exe
                                                                                                • Size 2.6MB
                                                                                                • SHA256 6304d2cd847d696e897e4767844688eae858f9208abcd6e1fd5400ddda20f4ad
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                EgIi.exe
                                                                                                • Path C:\Windows\EgIi.exe
                                                                                                • Size 2.2MB
                                                                                                • SHA256 e0e62d171b40d2a480741c161ac12bc4909364f4e8fee7ff1cb29dc32210a4b0
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Eokc.exe
                                                                                                • Path C:\Windows\Eokc.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 3fa8d10a4c3dad8f03730160794198a82174a619915164d75f62a6f558895d16
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                GAwW.exe
                                                                                                • Path C:\Windows\GAwW.exe
                                                                                                • Size 2.5MB
                                                                                                • SHA256 192642e5b952f55dc6824ba4c1027c87191bda20ee7650f387294754b4937ba8
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                GocM.ico
                                                                                                • Path C:\Windows\GocM.ico
                                                                                                • Size 4KB
                                                                                                • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                IQUQ.exe
                                                                                                • Path C:\Windows\IQUQ.exe
                                                                                                • Size 2.0MB
                                                                                                • SHA256 1c1ff9de1025d5d379c8a6a7b9417bb646ca0bdbe49f24a72724a9d9dd4b3724
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                IcQy.exe
                                                                                                • Path C:\Windows\IcQy.exe
                                                                                                • Size 1.9MB
                                                                                                • SHA256 d018e3c57edb85bd89c4a0fd6b5c1c1aa853a7d4b4737cdf4264388e5e2053c4
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                IswG.exe
                                                                                                • Path C:\Windows\IswG.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 168623c6ae40c673ff487c14bf718550649fd9d20b220301a0a3cd64da3d77e9
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                IyUc.ico
                                                                                                • Path C:\Windows\IyUc.ico
                                                                                                • Size 4KB
                                                                                                • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                KEEe.exe
                                                                                                • Path C:\Windows\KEEe.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 bf1c188f57b8b391fc6b1d31f10aa2f7cc2081ba84a63c1d14a43d631b5dd65c
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                KQUU.exe
                                                                                                • Path C:\Windows\KQUU.exe
                                                                                                • Size 1.9MB
                                                                                                • SHA256 495ec2ce43769713f22ff64d8a65b776e9cfe9979001e479fbf992971422df4a
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                KYQm.exe
                                                                                                • Path C:\Windows\KYQm.exe
                                                                                                • Size 2.2MB
                                                                                                • SHA256 d846fd35fb78a31102dddf1a546eef149ed71ece8c2244dc0f824c37b9d8904f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                KgwM.exe
                                                                                                • Path C:\Windows\KgwM.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 41de4f6b9818a60468170472440fe647fa6315d7548c291a9cc6fcf545ab4fdb
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                KoUu.exe
                                                                                                • Path C:\Windows\KoUu.exe
                                                                                                • Size 2.2MB
                                                                                                • SHA256 3cf7380d1b9a4974cad462a3575ae0b8fe35e93670286cc1a183b02f47d9adfa
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                MAMw.exe
                                                                                                • Path C:\Windows\MAMw.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 4788d0b30d42ef36f15963763749897bb051fa756dfdf242569a4706fe68162c
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                MEki.exe
                                                                                                • Path C:\Windows\MEki.exe
                                                                                                • Size 2.0MB
                                                                                                • SHA256 de84586a039c2921d697a7e6816b8c9236f617aa57a69dd4ec18e5a542718460
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                MQQm.exe
                                                                                                • Path C:\Windows\MQQm.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 d8e2d308890edc6d948048178377265684dc22d4160ee8f264d63bac203b6af2
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                MQkY.exe
                                                                                                • Path C:\Windows\MQkY.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 43c073c29a92ea7007319101403558c688b501e9801a3c6cca35370dc3071c4d
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                MeQM.ico
                                                                                                • Path C:\Windows\MeQM.ico
                                                                                                • Size 4KB
                                                                                                • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                MkYA.exe
                                                                                                • Path C:\Windows\MkYA.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 e64b27567c4a90e6cb38aaf3d511d2c3e982da87c5407a4432a25bc5113c1360
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                MoEq.exe
                                                                                                • Path C:\Windows\MoEq.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 3a5465296698a499e2d74e8b5d2847af9185a5de7592869b2686c2a9c8e47c5b
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                OMYk.exe
                                                                                                • Path C:\Windows\OMYk.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 b2dd8c5a2b9b1347dd7f63b56e7c6c6e915416380251f80ee9246e67de45be02
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                OUga.exe
                                                                                                • Path C:\Windows\OUga.exe
                                                                                                • Size 2.2MB
                                                                                                • SHA256 0d155b27a1a427f621312d5a49732c940114c29c9ca9bf764addd09064fad69f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                OUou.exe
                                                                                                • Path C:\Windows\OUou.exe
                                                                                                • Size 1.9MB
                                                                                                • SHA256 761b74e0f5fd1b2cfddf0743939422fe7bea9b57960643b7e435312835b2db23
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                OaEE.ico
                                                                                                • Path C:\Windows\OaEE.ico
                                                                                                • Size 4KB
                                                                                                • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Oocc.exe
                                                                                                • Path C:\Windows\Oocc.exe
                                                                                                • Size 2.5MB
                                                                                                • SHA256 01d808323d4f8cb72045c3a1ffa3e5bfc38591b2f4ca49f6ad9c0a5ae63670df
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                OsEM.exe
                                                                                                • Path C:\Windows\OsEM.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 98ccbeefab379587fe4dddcbc31717a6ecf25503d324a8a5526c513a6f913890
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                OsYQ.exe
                                                                                                • Path C:\Windows\OsYQ.exe
                                                                                                • Size 2.3MB
                                                                                                • SHA256 388e31e01d0dce6b251deb163e610cf74380249016378285360b51ddc7a9782d
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Ossk.exe
                                                                                                • Path C:\Windows\Ossk.exe
                                                                                                • Size 3.6MB
                                                                                                • SHA256 45635fc4d722d4a54b591349a9aaca832a11c4258eb0dc61df164d3c25243c2a
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Osso.ico
                                                                                                • Path C:\Windows\Osso.ico
                                                                                                • Size 4KB
                                                                                                • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                QAYm.exe
                                                                                                • Path C:\Windows\QAYm.exe
                                                                                                • Size 2.0MB
                                                                                                • SHA256 da9c6c165f012d4fb7625195d7136de2eb0a49bb0cbbf9634978ce68dd57f3a5
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                QsUA.exe
                                                                                                • Path C:\Windows\QsUA.exe
                                                                                                • Size 1.9MB
                                                                                                • SHA256 4b2992b4b0066db60319bdfd786f9ad3d31d03a48db0a6d73142f67621b78ee7
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                QwgY.exe
                                                                                                • Path C:\Windows\QwgY.exe
                                                                                                • Size 2.0MB
                                                                                                • SHA256 6119c98badad388d5638a736fd5f6a527d56b652844c8c5e903438a215da8baf
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Qwws.exe
                                                                                                • Path C:\Windows\Qwws.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 ad348844e0a56d595ffa20a51fdea44d01ebd1cff0663814cb054f6362576979
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                SEkm.exe
                                                                                                • Path C:\Windows\SEkm.exe
                                                                                                • Size 2.0MB
                                                                                                • SHA256 77e987a021d89a5deadd481f6fd6c23c71616afaf327553b23618d769b2c1fc4
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                SKok.ico
                                                                                                • Path C:\Windows\SKok.ico
                                                                                                • Size 4KB
                                                                                                • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                SUMy.exe
                                                                                                • Path C:\Windows\SUMy.exe
                                                                                                • Size 2.0MB
                                                                                                • SHA256 a6ee515cfbc6acfa4dae4ed56c5e7d155eac7542afe79c48d9f93b509c8958a5
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                SUkq.exe
                                                                                                • Path C:\Windows\SUkq.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 605975965aa69773d02f2da75baaf0ccca166668b9f71f5f8cfe175c54191fdd
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                SggI.ico
                                                                                                • Path C:\Windows\SggI.ico
                                                                                                • Size 4KB
                                                                                                • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                UEwq.exe
                                                                                                • Path C:\Windows\UEwq.exe
                                                                                                • Size 1.9MB
                                                                                                • SHA256 7103c0095826763105225ed0b7bdeda88bdb2baceb20284329aa747d0244d7b7
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                UIUu.exe
                                                                                                • Path C:\Windows\UIUu.exe
                                                                                                • Size 1.7MB
                                                                                                • SHA256 d3a42cf126ae88b5eda5f5bc347f11875dc6626f6b1a0d6735ad25f846d30bd2
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                UgQY.exe
                                                                                                • Path C:\Windows\UgQY.exe
                                                                                                • Size 2.1MB
                                                                                                • SHA256 b59eb5e822655711f8f7963bfe66fd082092aaf17e6d4696d03bf71d8d7df9c0
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                WIQs.exe
                                                                                                • Path C:\Windows\WIQs.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 351376cbee36b1f17ce5dbea0df12219624754027d27aa0d01c6e9d54c081936
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                WQMM.exe
                                                                                                • Path C:\Windows\WQMM.exe
                                                                                                • Size 2.1MB
                                                                                                • SHA256 e4804459b725026e5017576697349785159e6331feb058f3bc92cead7a72a245
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                WcYi.exe
                                                                                                • Path C:\Windows\WcYi.exe
                                                                                                • Size 2.2MB
                                                                                                • SHA256 9b82684d5ce568d46c3e4d76c63129b5e045a656d016453d63c26f2e366a793a
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                WowW.exe
                                                                                                • Path C:\Windows\WowW.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 f4e5c0c6119787842120df930adb4d1b0812c57f53f62df1e789bc14a8342e8d
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                YAwE.ico
                                                                                                • Path C:\Windows\YAwE.ico
                                                                                                • Size 4KB
                                                                                                • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                YIEy.exe
                                                                                                • Path C:\Windows\YIEy.exe
                                                                                                • Size 2.0MB
                                                                                                • SHA256 9675cd20c614757c8261cb9f4f847742b9844d228e4492506dfb00950cdd6fb6
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                YMMu.exe
                                                                                                • Path C:\Windows\YMMu.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 9b2370b306e8cd9cfa5666f55bea0348dd9b30f8e3cefbe9c35076462cf1fd00
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                YUIY.exe
                                                                                                • Path C:\Windows\YUIY.exe
                                                                                                • Size 1.7MB
                                                                                                • SHA256 6a49f54069713d0994d939ed031729534a1ca305eb4a58f12dba184ae6aec4e2
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                YcIW.exe
                                                                                                • Path C:\Windows\YcIW.exe
                                                                                                • Size 1.8MB
                                                                                                • SHA256 b8bb025db5cee0ad3f298efc411bdfed393bf07b3c2802ce8fd2723fc225c76c
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                YcQC.exe
                                                                                                • Path C:\Windows\YcQC.exe
                                                                                                • Size 1.8MB
                                                                                                • SHA256 f6e7613d571172a187b7cce1cab64f7d7cc0dcd208b0cbfab95f1d17b0599692
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Ygci.exe
                                                                                                • Path C:\Windows\Ygci.exe
                                                                                                • Size 1.8MB
                                                                                                • SHA256 0535cf0d847275428b8cf9cf1975ea520e0f306bcb6d04c97466139b89f1eca9
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                YkcM.exe
                                                                                                • Path C:\Windows\YkcM.exe
                                                                                                • Size 1.8MB
                                                                                                • SHA256 52407d925b1e2c2632ea3c7587a4156841ebf2264f53489b2781e154ef35b92e
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                YoMG.exe
                                                                                                • Path C:\Windows\YoMG.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 fd84138ecf9973a8e374fd695e1f0b3aa3a511756aef61f0b6a185b866c3eed2
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                aMEw.exe
                                                                                                • Path C:\Windows\aMEw.exe
                                                                                                • Size 2.2MB
                                                                                                • SHA256 81300a43671b31a8a2dbb74a3cbb016f2d67c11731a8346bb63a4c16b396862c
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                aMUK.exe
                                                                                                • Path C:\Windows\aMUK.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 7a3c6441dc703d50979b9b38c3247266e1ef09d2e73772081cf6e76bcc56e4d7
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                acwU.exe
                                                                                                • Path C:\Windows\acwU.exe
                                                                                                • Size 2.2MB
                                                                                                • SHA256 70b797eb2791a03abfa35845d644c0656a39fccefc984394ada7fc73fad05917
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                cAsK.exe
                                                                                                • Path C:\Windows\cAsK.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 8b4917a51f10ca715f2614c687f56da98d8ae385ef57f983a19cf73737b26386
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                cEgw.exe
                                                                                                • Path C:\Windows\cEgw.exe
                                                                                                • Size 2.0MB
                                                                                                • SHA256 19780d07cbabfa4b2c0ad56796177d2cf5eb3a76829b6b6267c5d8612d09e070
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                cUYI.exe
                                                                                                • Path C:\Windows\cUYI.exe
                                                                                                • Size 2.2MB
                                                                                                • SHA256 c64e744819fe5dd04e29335f425e8b5880dcedbe734bc2409158c0942061278f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                cgsi.exe
                                                                                                • Path C:\Windows\cgsi.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 c6f1367b514d17963153cea1028729efd0342269f6992fae8cbd60f94ece83bd
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                ckoY.exe
                                                                                                • Path C:\Windows\ckoY.exe
                                                                                                • Size 2.3MB
                                                                                                • SHA256 e7c35615f437a2849288b935bdfc447e36c4fee6e26516a66dbd3588a19e1ac9
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                eMQq.exe
                                                                                                • Path C:\Windows\eMQq.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 c42715c67ef159156c9cf23bc9defe524530e89303c364a5d89965c65dcbf494
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                eMoc.exe
                                                                                                • Path C:\Windows\eMoc.exe
                                                                                                • Size 2.2MB
                                                                                                • SHA256 4efd385684a2de09a0c6f7f0d0347a93484335663d13810e3b8388971f5122a1
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                eQQE.exe
                                                                                                • Path C:\Windows\eQQE.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 b5ebfd43056037a0e025853f9a691f07cc54ecdeb15eab0f1fa9dc3666c36c50
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                eUEA.exe
                                                                                                • Path C:\Windows\eUEA.exe
                                                                                                • Size 2.0MB
                                                                                                • SHA256 0336ac2159d3f9b5ec9a2513b6e205d14c8392bf4b0453af49d1cd3d4d3391a9
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                egki.exe
                                                                                                • Path C:\Windows\egki.exe
                                                                                                • Size 1.8MB
                                                                                                • SHA256 2432fe93dd1e788cbd7a5499d4ebe473d2e5bbce77a17b468bacdd1a9445d9f9
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                gQIM.exe
                                                                                                • Path C:\Windows\gQIM.exe
                                                                                                • Size 2.0MB
                                                                                                • SHA256 b2948a78e3de7446765780d4546fce96361542c84ad0f60fdca285dabc25ccc7
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                gUcC.exe
                                                                                                • Path C:\Windows\gUcC.exe
                                                                                                • Size 2.0MB
                                                                                                • SHA256 dfa0fdc3a400a077ea6594cb6e927f489ea1ba72be32d70e78b8d28e99b95e88
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                iYEA.exe
                                                                                                • Path C:\Windows\iYEA.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 427a6f7cdccbc0c37ffbf929da3ac221cf35267b8718b8387da6c95615d82150
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                iccw.exe
                                                                                                • Path C:\Windows\iccw.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 df2a83a3f200a2e4706556b65b806f2dc62e8caa23c2db80d1ce50dcef5d625a
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                kAYy.exe
                                                                                                • Path C:\Windows\kAYy.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 5a54c4223336ff387a1977551c446f6db814c4e2715f7b396d36d5b6782f3025
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                kYQE.exe
                                                                                                • Path C:\Windows\kYQE.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 4f7fbca3bbd6071390d188cc42a6a2f2638c5fc3e63cf0bd29bbad32efb1e9e1
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                kcUA.exe
                                                                                                • Path C:\Windows\kcUA.exe
                                                                                                • Size 2.2MB
                                                                                                • SHA256 87b0e7b37a563746da976fdf2a3b86bb3873e51f2c37b84fbed5f3fd3d7b8096
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                mMAQ.exe
                                                                                                • Path C:\Windows\mMAQ.exe
                                                                                                • Size 2.4MB
                                                                                                • SHA256 decd22eb89bd2279e5f70f537c71b4dcb0d402e26f8cab2b5d80a5196fb06704
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                mcEa.exe
                                                                                                • Path C:\Windows\mcEa.exe
                                                                                                • Size 1.8MB
                                                                                                • SHA256 c71755dde4fd66f9cb0be28b640a1e78b97d653b7a5d0de69ab34fd050d09d02
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                mcco.exe
                                                                                                • Path C:\Windows\mcco.exe
                                                                                                • Size 1.8MB
                                                                                                • SHA256 11136be9cd8298298b7206fcb7b9964c77137b13c5de01fbbf1ba55e6b190c40
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                mosM.exe
                                                                                                • Path C:\Windows\mosM.exe
                                                                                                • Size 1.7MB
                                                                                                • SHA256 40d0aae38c2cc0e70f8d6731fc296ca0a78c640654f69e94f7393848471722d0
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                ocUc.exe
                                                                                                • Path C:\Windows\ocUc.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 ec0682a31700adcdbf92ad68eca9c01b75476021bb22cd7a0e9e9441f1b6dbe9
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                owIU.ico
                                                                                                • Path C:\Windows\owIU.ico
                                                                                                • Size 4KB
                                                                                                • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                owoU.exe
                                                                                                • Path C:\Windows\owoU.exe
                                                                                                • Size 2.0MB
                                                                                                • SHA256 7ee646f67a7374bc1461027217cdb81c368ebd943ad057d4497661f34d0c8cac
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                qAUE.exe
                                                                                                • Path C:\Windows\qAUE.exe
                                                                                                • Size 2.9MB
                                                                                                • SHA256 7c4fe83375f873ffead5fc8db1bdebe87afa3d556ac0c613c78e0840529a4784
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                qEYK.exe
                                                                                                • Path C:\Windows\qEYK.exe
                                                                                                • Size 1.8MB
                                                                                                • SHA256 eab938303c8e46557c4d788dcbf96f1cfde77d698c50bd6fa404d1a8363be473
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                qQIw.exe
                                                                                                • Path C:\Windows\qQIw.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 bbd0d4502138fe5061d1e340bd97abaa45765719049b84517a6fb7633a193fc6
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                qQcy.exe
                                                                                                • Path C:\Windows\qQcy.exe
                                                                                                • Size 1.9MB
                                                                                                • SHA256 b9584affaddf40d175cff82e8df51bf6209b365f0ca0faf22adcedcda7f30a54
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                qUga.exe
                                                                                                • Path C:\Windows\qUga.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 a648d7c72d8ea9aa9b09a33c369b8396be29376ee3652b0d2442ab35b9c99135
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                qkoS.exe
                                                                                                • Path C:\Windows\qkoS.exe
                                                                                                • Size 2.4MB
                                                                                                • SHA256 33b9aa65d824a267441712c139f326a01eb657e4bc25fbe5bb7964f7517661da
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                qwoS.exe
                                                                                                • Path C:\Windows\qwoS.exe
                                                                                                • Size 2.0MB
                                                                                                • SHA256 3562c1ece7943f0bddba6fbe3fb06c1248f7d7a6f4c36580526d34eb64563f01
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                sEwI.exe
                                                                                                • Path C:\Windows\sEwI.exe
                                                                                                • Size 2.1MB
                                                                                                • SHA256 393039558770cf263ec1224e16d0146ea2b7ef47be5c5bf01736a0a9a67d928c
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                sQYm.exe
                                                                                                • Path C:\Windows\sQYm.exe
                                                                                                • Size 2.6MB
                                                                                                • SHA256 5284be0699b31abf5d0c5c8625a6dc64b04245febcad1798b9b3c36a4903955d
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                sQoq.exe
                                                                                                • Path C:\Windows\sQoq.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 f7e0db3a72c57fb13de67d76126efdcf84075f0c8b96f41b6831a6212ded5fcf
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                sUcI.exe
                                                                                                • Path C:\Windows\sUcI.exe
                                                                                                • Size 1.9MB
                                                                                                • SHA256 cefe6453fb31fae61a8f7d0da83cb6e1fc0f2b8cf0e63c08f78f73ce86488f00
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                sYQa.exe
                                                                                                • Path C:\Windows\sYQa.exe
                                                                                                • Size 2.2MB
                                                                                                • SHA256 c9f59e0d949e068838e5ba7178b643d7d3b54e129337e83728f56f0f685b78f2
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                sYou.exe
                                                                                                • Path C:\Windows\sYou.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 94e74467c42c47348a4ed80df6901c54bc3648693561b3967c8e5f09a9553de4
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                scwe.exe
                                                                                                • Path C:\Windows\scwe.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 06a21e7fe5c4966d99e0941029b264337352595e6c8faf1ae52b4408260d27f2
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                sgkK.exe
                                                                                                • Path C:\Windows\sgkK.exe
                                                                                                • Size 1.8MB
                                                                                                • SHA256 e4462676f5a8317ca60129e23a1b618f08efd63e5dacee957deece2e38042624
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                sgkg.exe
                                                                                                • Path C:\Windows\sgkg.exe
                                                                                                • Size 1.7MB
                                                                                                • SHA256 73fa94c923dc2d0ff121f6dab35d2e1d5dc20ede6617528b16f2a0348105beec
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                uAMU.exe
                                                                                                • Path C:\Windows\uAMU.exe
                                                                                                • Size 1.9MB
                                                                                                • SHA256 e00fa24c5933c29dbded0d8f036071d1577e9d4aad5190fa6a5378eb438c525d
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                uAsK.exe
                                                                                                • Path C:\Windows\uAsK.exe
                                                                                                • Size 2.2MB
                                                                                                • SHA256 35b8e204ad51a1343d1c5a1a2e5fe6cdb9e5a57b1b0298287797953950624103
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                uMAW.exe
                                                                                                • Path C:\Windows\uMAW.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 8c64eb63dd99408d48e2fbc7a3c16b481052c7c93e42756d507c850c69dc6ef6
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                uMQK.exe
                                                                                                • Path C:\Windows\uMQK.exe
                                                                                                • Size 1.7MB
                                                                                                • SHA256 df7b4fcdd4f137478287be2731f8b9f6654d600b6c59212b19461a0c78e00282
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                uMgQ.exe
                                                                                                • Path C:\Windows\uMgQ.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 568994e66446099a22f2d79c6232f720f9c5723ce3fc491be3e89e9c07d8b467
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                ucYK.exe
                                                                                                • Path C:\Windows\ucYK.exe
                                                                                                • Size 1.9MB
                                                                                                • SHA256 b2962de12971b38157d8537d59cef59f82b7c7f86c7dbb8f8c410f584fcb14ce
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                usIg.exe
                                                                                                • Path C:\Windows\usIg.exe
                                                                                                • Size 1.9MB
                                                                                                • SHA256 ba3a21de2ef4f982c9f01c76e686327fbfcf86dab29748af17882d435475e2d3
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                wUsK.exe
                                                                                                • Path C:\Windows\wUsK.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 6e4c26384c857c6b74374b9637e4d1bee086c0b65e807c0733d64d413f8db988
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                wUwq.exe
                                                                                                • Path C:\Windows\wUwq.exe
                                                                                                • Size 1.9MB
                                                                                                • SHA256 d1cd30ca1c9bb57f6d7f2b34ba13715faaeb6ba384cfff427cae78c6c753ffd7
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                wYsw.exe
                                                                                                • Path C:\Windows\wYsw.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 fc8ab70b450de78a251a91d346393f08e96daa625f71428bf0d1971f0198c5b5
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                yQgA.exe
                                                                                                • Path C:\Windows\yQgA.exe
                                                                                                • Size 1.9MB
                                                                                                • SHA256 53515a5997add66450ac3190b0f1f1a52f78a21718721dd2950e44cf0ad58e16
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                ygcq.exe
                                                                                                • Path C:\Windows\ygcq.exe
                                                                                                • Size 1.6MB
                                                                                                • SHA256 67f87a2d6f1d0d1cf8625c672602920ac81e420710a4247764cc4d9b7eb7d1b0
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                ykgu.exe
                                                                                                • Path C:\Windows\ykgu.exe
                                                                                                • Size 2.2MB
                                                                                                • SHA256 702baf02d58855eb160fa17316ba7487f927cf5dcb0bf5dd048c18c32105fed7
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                memory/1072-342-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/1140-155-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/1164-125-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/1240-168-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/1280-215-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/1500-246-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/1500-233-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/1628-1921-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                Download

                                                                                                memory/1628-19-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                Download

                                                                                                memory/1840-67-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/1864-379-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/1864-452-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/1880-81-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/2052-258-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/2528-1041-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/2764-991-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/3176-111-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/3192-320-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/3316-289-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/3444-1-0x0000000002340000-0x0000000002360000-memory.dmp
                                                                                                Download

                                                                                                memory/3444-34-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/3444-0-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/3444-35-0x0000000002340000-0x0000000002360000-memory.dmp
                                                                                                Download

                                                                                                memory/3528-269-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/3640-591-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/3640-646-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/3736-703-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/3844-883-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/4056-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                Download

                                                                                                memory/4056-1910-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                Download

                                                                                                memory/4060-97-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/4360-310-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/4636-362-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/4736-330-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/4956-51-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/4964-17-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                Download

                                                                                                memory/4964-1915-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                Download

                                                                                                memory/5100-226-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/5140-139-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/5436-1931-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                Download

                                                                                                memory/5504-186-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/5540-237-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/5572-570-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/5660-200-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/5828-1926-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                Download

                                                                                                memory/5860-797-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/5932-299-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download

                                                                                                memory/6028-279-0x0000000000400000-0x000000000059B000-memory.dmp
                                                                                                Download