Overview

overview

10

Static

static

3

2026-08-09...ck.exe

windows10-2004-x64

10

2026-08-09...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 08:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
  • Size 1.7MB
  • Sample260809-kcj8datfka
  • SHA256 ae72f5b5f0c947c56cf0f74d37762c5ec8f0ceed0a4d2eb0a37122cd8fb53b7c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 60 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 60 IoCs
    defense_evasiontrojan
  • Renames multiple (101) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 9 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 59 IoCs
    execution
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Users\Admin\EiIkUIgc\kCYEsoEQ.exe
      "C:\Users\Admin\EiIkUIgc\kCYEsoEQ.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3804
    • C:\ProgramData\SEwUEwMY\JcwgUIgA.exe
      "C:\ProgramData\SEwUEwMY\JcwgUIgA.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:5860
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4776
      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2548
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2516
          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1160
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5960
              • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4852
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2412
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:1372
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1672
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3616
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4232
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                            13⤵
                            • Adds Run key to start application
                            PID:2928
                            • C:\Users\Admin\QgEIkcUU\IQcAsYEY.exe
                              "C:\Users\Admin\QgEIkcUU\IQcAsYEY.exe"
                              14⤵
                                PID:3424
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 264
                                  15⤵
                                  • Program crash
                                  PID:2564
                              • C:\ProgramData\rgsoUkwQ\ZgAEkwIk.exe
                                "C:\ProgramData\rgsoUkwQ\ZgAEkwIk.exe"
                                14⤵
                                  PID:2400
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 264
                                    15⤵
                                    • Program crash
                                    PID:4412
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                  14⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2620
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                    15⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:1848
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                      16⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:5616
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                        17⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:260
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                          18⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3276
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                            19⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:4224
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                              20⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:4904
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                21⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:2172
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                  22⤵
                                                  • Executes a command shell one-liner
                                                  PID:1992
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                    23⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2540
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                      24⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2184
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                        25⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:6072
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                          26⤵
                                                          • Executes a command shell one-liner
                                                          PID:4900
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                            27⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:5944
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                              28⤵
                                                                PID:1196
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                  29⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:3132
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                    30⤵
                                                                    • Executes a command shell one-liner
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4372
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                      31⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:3436
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                        32⤵
                                                                        • Executes a command shell one-liner
                                                                        PID:4316
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                          33⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:820
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                            34⤵
                                                                            • Executes a command shell one-liner
                                                                            PID:3952
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                              35⤵
                                                                                PID:5708
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                  36⤵
                                                                                    PID:3612
                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                      37⤵
                                                                                        PID:3780
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                          38⤵
                                                                                          • Executes a command shell one-liner
                                                                                          PID:1408
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                            39⤵
                                                                                              PID:3000
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                40⤵
                                                                                                • Executes a command shell one-liner
                                                                                                PID:3316
                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                  41⤵
                                                                                                    PID:5172
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                      42⤵
                                                                                                        PID:6076
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                          43⤵
                                                                                                            PID:1048
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                              44⤵
                                                                                                                PID:1544
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                  45⤵
                                                                                                                    PID:2352
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                      46⤵
                                                                                                                        PID:52
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                          47⤵
                                                                                                                            PID:2112
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                              48⤵
                                                                                                                                PID:2436
                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  49⤵
                                                                                                                                    PID:4856
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                    49⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:1368
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                      50⤵
                                                                                                                                        PID:2564
                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          51⤵
                                                                                                                                            PID:1500
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                            51⤵
                                                                                                                                              PID:3172
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                52⤵
                                                                                                                                                  PID:4420
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                    53⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:3460
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                      54⤵
                                                                                                                                                        PID:672
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                          55⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:3144
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                            56⤵
                                                                                                                                                              PID:3560
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                57⤵
                                                                                                                                                                  PID:5040
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                    58⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:3012
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                      59⤵
                                                                                                                                                                        PID:6140
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                          60⤵
                                                                                                                                                                            PID:2988
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                              61⤵
                                                                                                                                                                                PID:928
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                  62⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:1488
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                    63⤵
                                                                                                                                                                                      PID:4808
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                        64⤵
                                                                                                                                                                                          PID:3852
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                            65⤵
                                                                                                                                                                                              PID:868
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                66⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:3956
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                    PID:5696
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:4536
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                        69⤵
                                                                                                                                                                                                          PID:2444
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:3008
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                              71⤵
                                                                                                                                                                                                                PID:568
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                    PID:4788
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                      73⤵
                                                                                                                                                                                                                        PID:5884
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:4492
                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                              PID:3040
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                              75⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:896
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:3860
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                  77⤵
                                                                                                                                                                                                                                    PID:3284
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                        PID:4132
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                          79⤵
                                                                                                                                                                                                                                            PID:4616
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                              80⤵
                                                                                                                                                                                                                                                PID:5768
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                  81⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:1116
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:4320
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                      83⤵
                                                                                                                                                                                                                                                        PID:5728
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                          84⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:700
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                            85⤵
                                                                                                                                                                                                                                                              PID:5080
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                                86⤵
                                                                                                                                                                                                                                                                  PID:5476
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                                                                                      PID:3404
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                                        88⤵
                                                                                                                                                                                                                                                                          PID:5624
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                            89⤵
                                                                                                                                                                                                                                                                              PID:1312
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                                                90⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:804
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                                                                                                    PID:1824
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                                                                                                        PID:2964
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                                                                                                            PID:2256
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:4060
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                                                                                                  PID:3044
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                                                                                                    PID:5520
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:5460
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                                                                                                          PID:4812
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:1748
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                                                                                                                PID:4832
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:2080
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:1960
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                                        PID:4568
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                                                                                                            PID:5724
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:5848
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                                                                                                  PID:5992
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:5236
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                                                                                                        PID:2828
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:5812
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                                                                                                              PID:5408
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1444
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4672
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5868
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:704
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:2084
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5716
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:940
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:472
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5948
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1940
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1600
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5904
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3864
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:5024
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3488
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4796
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:3388
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:5692
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2432
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2956
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5232
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              PID:5564
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ICsAcwgA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:4656
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:5148
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                          PID:5772
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4524
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:5112
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1176
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kyAcIMMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:2968
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:204
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:4848
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4308
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:1268
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:5988
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sEkYUMoQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:4256
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                              PID:1656
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        PID:3488
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:1412
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:4796
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tMoIUcgA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:5788
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:6104
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    PID:5448
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:2956
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:2020
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3136
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DQAUocsc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:5628
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3476
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:2560
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5112
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                      PID:2312
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fAAYgcMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:5736
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:4396
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:1268
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1588
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4824
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5324
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        PID:4308
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lAkYYMQs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:4244
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:5760
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    PID:1596
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5648
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1700
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        PID:4172
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cuAggUgk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4476
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1932
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                              PID:6060
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        PID:3136
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:2020
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        PID:4876
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4644
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AMMcAIME.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:5320
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5880
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                              PID:5904
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:5948
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5844
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4432
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:1176
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:256
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OckUsYcA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5064
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            PID:4336
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5248
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:1084
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              PID:5324
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2640
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TysAowcQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1208
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:2732
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5648
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                PID:4772
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tCAcgEgU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:3588
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5788
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:4688
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5880
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1244
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                PID:3648
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HmkskMIY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4444
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:4708
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3412
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  PID:256
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ksYEEQEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5064
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:1104
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:5248
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4560
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                90⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                PID:3736
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qOYcUQQo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                90⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2080
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            PID:480
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:1596
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:5668
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GuoYsIss.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4840
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:2924
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:4168
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                          PID:5132
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                          PID:5720
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rScwEEow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:4264
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                            PID:4988
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                      PID:1164
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1228
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        84⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:5844
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lAQkEAcs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        84⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:4896
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:4488
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:4948
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3412
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      82⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      PID:2256
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HukQwEkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      82⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:5272
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        83⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:1600
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  PID:624
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4432
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    PID:3736
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oeIsAMQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:4640
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                      81⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:788
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:6104
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  78⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  PID:5036
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  78⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3660
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:2252
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CaoUEQEc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:4180
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:1700
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:4644
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5824
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:4168
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uOAoQMgc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2016
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      77⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:3228
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                PID:1212
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4380
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:5320
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:1228
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rgIIAogY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:4600
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:3928
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              PID:4560
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:2640
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:4268
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\feocEQcg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:4112
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                73⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4888
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:5232
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            PID:1940
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3864
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                              PID:5768
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XIoskYQA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4072
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  71⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                  PID:2736
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            PID:4180
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3660
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                              PID:4132
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MSkgoskE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:248
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                  PID:1256
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            PID:4796
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:2016
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:3860
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sOAgsEQY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:2340
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:3768
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:5436
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:3136
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:1360
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iOowsYkE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:2800
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          PID:3696
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:4692
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4268
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                        63⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2592
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        PID:5332
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\biUswsIU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:5116
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          63⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          PID:296
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    PID:1268
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:5648
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                    PID:1588
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lusgAYUc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:5796
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                      61⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                      PID:1264
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                PID:3404
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:1312
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                PID:2992
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zKQwEkYE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:2052
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                  PID:1700
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                            PID:5416
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                            PID:1960
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                            PID:788
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZyAAMwMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2696
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                57⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                PID:1932
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                          PID:4688
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3044
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                            PID:3760
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gqcwskgc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4108
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                55⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                PID:5716
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                          PID:3040
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2736
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                            PID:5332
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UWkMckAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:3192
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                              53⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                              PID:4128
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                        PID:3476
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4408
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                          50⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:4272
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          50⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:5796
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dmYAEsos.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          50⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:3324
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:2592
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      PID:1596
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                      PID:2992
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                      PID:1064
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZUwwAokA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1216
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5192
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            49⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:2988
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                      PID:5040
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                      PID:5696
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                      PID:4956
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rYAQAgAo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3340
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                          47⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                          PID:5904
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                    PID:4860
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5824
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                      PID:5436
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NQYgAEMc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2808
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                          45⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                          PID:3560
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                    PID:4856
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:3404
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                    PID:4440
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SWswMMsE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:2632
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                      43⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                      PID:1164
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                PID:4268
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4812
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                    41⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2080
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                    PID:2052
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nCwQEYII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    PID:1796
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                      41⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                      PID:5412
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                PID:672
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                PID:5824
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                PID:4260
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZOkoUEMk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:416
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                  39⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                  PID:4380
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:2196
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                              37⤵
                                                                                                                                                                                                                                                                                                                                                PID:2916
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                              36⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                              PID:1216
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                              36⤵
                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                              PID:4072
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IuocQYIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                              36⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:3552
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                37⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                PID:4888
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                          PID:4832
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                          PID:4508
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                          PID:4336
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pAkUYQAk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                                                                                                                                                            PID:5000
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                              35⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                              PID:3316
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                        32⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                        PID:3852
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                        32⤵
                                                                                                                                                                                                                                                                                                                                          PID:1548
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                          PID:4408
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XsgIgYsc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                            PID:756
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                              33⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:4264
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                        PID:616
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                        PID:4856
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                        PID:2988
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MWEkEUAk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                                                                                          PID:4744
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                            31⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                            PID:4860
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                      28⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                      PID:4108
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                      28⤵
                                                                                                                                                                                                                                                                                                                                        PID:5868
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                        PID:4172
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HYcYYoEs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:980
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                          29⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                          PID:4788
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                    26⤵
                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:3736
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                    26⤵
                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                    PID:4672
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                    26⤵
                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                    PID:1216
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UgcMgoUU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                    26⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:4084
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                      27⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                      PID:4444
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                24⤵
                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:5272
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                24⤵
                                                                                                                                                                                                                                                                                                                                  PID:5484
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:3956
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wWgIIQUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                                                                                                                                                    PID:3724
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                      25⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:6104
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                22⤵
                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:3436
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                22⤵
                                                                                                                                                                                                                                                                                                                                  PID:1716
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                  PID:1500
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oGQMYIsg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  PID:5044
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                    23⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                    PID:4180
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                              PID:4744
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                              PID:3940
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                              PID:416
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DeQcwkMI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:2996
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                21⤵
                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:5628
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                          PID:1044
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                                                                            PID:2916
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                            PID:2084
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fUYYQMIk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                            PID:4668
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                              19⤵
                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                              PID:5248
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                        PID:1212
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                          PID:4108
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                          PID:5000
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TKoIQAwE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                          PID:4196
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                            PID:2432
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                      PID:1216
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:3664
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:5780
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WecwYskc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                      PID:3572
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                        PID:5564
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                  PID:3780
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                    PID:1244
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                    PID:4892
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GIwccgsM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                    PID:3260
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                      PID:1716
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                PID:5648
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                  PID:1752
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                  PID:700
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UskEkwYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                  PID:5512
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:5448
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:1580
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:5192
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                              PID:2080
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JwUMEgUY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                              PID:3308
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                PID:2992
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:4508
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                            PID:2168
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                            PID:2736
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BaEMAMYg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                            PID:3836
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:5784
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                        PID:5968
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                          PID:3956
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                          PID:4808
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\owgQUIQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                          PID:5600
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                            PID:5060
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                      PID:4412
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                      PID:1188
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                      PID:4936
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KsYUAoYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                      PID:2876
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                        PID:2352
                                                                                                                                                                                                                                                                                                  • C:\ProgramData\MOccMMIw\jWckwEYA.exe
                                                                                                                                                                                                                                                                                                    C:\ProgramData\MOccMMIw\jWckwEYA.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                    PID:1976
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\EiIkUIgc\kCYEsoEQ.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\EiIkUIgc\kCYEsoEQ.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                    PID:2324
                                                                                                                                                                                                                                                                                                  • C:\ProgramData\SEwUEwMY\JcwgUIgA.exe
                                                                                                                                                                                                                                                                                                    C:\ProgramData\SEwUEwMY\JcwgUIgA.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                    PID:2000
                                                                                                                                                                                                                                                                                                  • C:\ProgramData\MysgUAgg\LcowIkAE.exe
                                                                                                                                                                                                                                                                                                    C:\ProgramData\MysgUAgg\LcowIkAE.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:4280
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 260
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                                        PID:2312
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3424 -ip 3424
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:1408
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4280 -ip 4280
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:5068
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2400 -ip 2400
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:4864
                                                                                                                                                                                                                                                                                                          • C:\ProgramData\rgsoUkwQ\ZgAEkwIk.exe
                                                                                                                                                                                                                                                                                                            C:\ProgramData\rgsoUkwQ\ZgAEkwIk.exe
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:2720
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 236
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                                PID:3116
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\QgEIkcUU\IQcAsYEY.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\QgEIkcUU\IQcAsYEY.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:5408
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2720 -ip 2720
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:3108
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5408 -ip 5408
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:5968

                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                        T1059

                                                                                                                                                                                                                                                                                                                        Visual Basic

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1059.005

                                                                                                                                                                                                                                                                                                                        Windows Command Shell

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1059.003

                                                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                                                        Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548

                                                                                                                                                                                                                                                                                                                        Bypass User Account Control

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548.002

                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                                                        Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548

                                                                                                                                                                                                                                                                                                                        Bypass User Account Control

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548.002

                                                                                                                                                                                                                                                                                                                        Hide Artifacts

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1564

                                                                                                                                                                                                                                                                                                                        Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1564.001

                                                                                                                                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1562

                                                                                                                                                                                                                                                                                                                        Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1562.001

                                                                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                                                        Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1555

                                                                                                                                                                                                                                                                                                                        Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1555.003

                                                                                                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                        IusI.txt
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\IusI.txt
                                                                                                                                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                                                                                                                                        • SHA256 cdba811bb5ef7f92177cccf22e3f2ce57adc052d1371d7eb49a60c20815e0964
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        jWckwEYA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\MOccMMIw\jWckwEYA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 a371121318aa0e9ccf071b58bb37722e9e7fe366630a2d92e0571406992352d0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        JcwgUIgA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\SEwUEwMY\JcwgUIgA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 5520d5560ca43e56f4bd39f0c4922546d19e4da12cbc71522524ac0b0194c0d0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-09_3cb0e854704c9ccc3de969ee5e83e7a2_elex_virlock
                                                                                                                                                                                                                                                                                                                        • Size 126KB
                                                                                                                                                                                                                                                                                                                        • SHA256 d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KsYUAoYo.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\KsYUAoYo.bat
                                                                                                                                                                                                                                                                                                                        • Size 112B
                                                                                                                                                                                                                                                                                                                        • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        file.vbs
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                        • Size 19B
                                                                                                                                                                                                                                                                                                                        • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kCYEsoEQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\EiIkUIgc\kCYEsoEQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8fc917cebdba0f9caa1c6c17c513b8a4ed686b7eb70f7a3e0e4240703439d19a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kCYEsoEQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\EiIkUIgc\kCYEsoEQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f41dbe3e9e67200880f444f9ca7e1c5c085cbc6513c30c2dbddfc35054fbfda7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kCYEsoEQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\EiIkUIgc\kCYEsoEQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f5a46c53dd5398c49362481463da8950e8331af299c82d019f349f2040437003
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kCYEsoEQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\EiIkUIgc\kCYEsoEQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 ab836498e782d1c4abc9656a4c4eb839c7a3e2742229abb5ecba65d1d5d2b719
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kCYEsoEQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\EiIkUIgc\kCYEsoEQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 f66d6cb25f5e41c78dfc1b13edc6d77febd785951df5bfca163ed656120b7c99
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kCYEsoEQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\EiIkUIgc\kCYEsoEQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 3d09d50314f506dc2a2e3914b0dfdb5944eeb20d00ece66505e7a818c8dd87eb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kCYEsoEQ.inf
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\EiIkUIgc\kCYEsoEQ.inf
                                                                                                                                                                                                                                                                                                                        • Size 4B
                                                                                                                                                                                                                                                                                                                        • SHA256 c18d54cbf43a3924d650fe39ea43f4764c26c8143c2c323ad503e2e3331da4df
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        AQwK.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\AQwK.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 30fa8ef8646b3d665c4beb607dcd360258950fdef3903988514154a39f854257
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        AUMs.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\AUMs.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3db4d34906eaeee645bb8489603c856dd569e37ca18727e39bb7e403ef213ae0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        AYgo.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\AYgo.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6ecd24e065b085b88afe1682c7db76e32be6d5e8b2de86abe906c688dcb78cae
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        AgcO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\AgcO.exe
                                                                                                                                                                                                                                                                                                                        • Size 3.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 2f6286a6486669f70a824965f8ddc52353d605c538692db5169f80b39267b4bf
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Akgw.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\Akgw.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8b009c35e29f0470d9e7c932b07c9e491c859da73a3fa3cb4c962634a35bc4c2
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        AoIU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\AoIU.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 283724104332a28dd1216216342ba8b6cf731df1314ce73e68ee1802e2c8c163
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        AskK.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\AskK.exe
                                                                                                                                                                                                                                                                                                                        • Size 3.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 30463977c83903c0b46f2b5d6971bf53e1f3478a9807b214bc44561e7ea5cc50
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CAsQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\CAsQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 5a5505fea49197946562788d6e30ac55f5028b0389e6b90f331f499991bc33a4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CYEs.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\CYEs.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e51636a804b18a46d95beaa7e5f4e0c4e83cc66d7db8e6a027b51d732f398b1e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CskY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\CskY.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 fa8292b1be3e94050af9efd7e19712a353ed1193abb4379132009892619912e7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        CwMS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\CwMS.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.4MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ac59e891e7a9a3f049cf0188711039b88a07e1596d39d3b649f3d3b2dc7a5980
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        EEMw.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\EEMw.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6e2e9a84e2e178a8611a431c96500c78b10fd7b575d4be107a467dc2c3941005
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        EIAO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\EIAO.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 695ae49b98b4eaeb59dace1ceb7d463224f6934ded2e53149045396884ab9f68
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        EMkG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\EMkG.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6518aab44af2b90274d863c6d3a75825561e8d2a79f9757737f9d0bff9b5bad0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        EQoQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\EQoQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 fac52eaf85423af400f4be6cc25327ea815abff2cb8e2ab92bf086a453065232
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        EmEY.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\EmEY.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Eoss.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\Eoss.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 564ecd636f193400b802bc3bb36d8e60d232d9e98874b6ac090caf5def3e6ee5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        EsQO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\EsQO.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1daa256cfd035d024d24430ef67d11c1f9a9acbfe2a36aeb72ae3b1e85d021a0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        EwMs.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\EwMs.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 a34a4efc880d8255257570aa41ba0f09e1d1b26b60f77450f382e846790cdf4d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        EwoA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\EwoA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 319c3f37386b1be03c6555bba3a527bc258c61e8ecae31c31efeff7cb8841b28
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GGYQ.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\GGYQ.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GgUo.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\GgUo.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4c2a9627f27593c1ed7ee4e8d4f3218635cd615ece783315f2aa2f27e3b15b2f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GkAu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\GkAu.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b940f5d894d4dbc98293f6d106e64cdb6f75bd49ad42dca4986a32d41878e066
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Gogg.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\Gogg.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f200144fd74a0b7eb094a3ff1bd11bea48eb227ae6e379ad9720c98dd1e806aa
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GsYU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\GsYU.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ce99b74e132e5e51050d0dcbcd87890c82e26e0bacc2a76cb2745706111a11ba
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        GwUe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\GwUe.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 9e46681f977e19ef95b07089f8d11e05b9f9ed4bfb4bbf90ee44f8b6d263fc63
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IAQA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\IAQA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7315e107820617ec2c156065a964fc82a8f6dc6848a784b5d2e8b5417c415c59
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IAgG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\IAgG.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b72aa4e25787876812d13b846a9c366f5847c959418c0f103ca350a66ba0ebff
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IEcc.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\IEcc.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IIsM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\IIsM.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 2f759f75cce63530e5a0b21c163263640b6da8bb5c360ea03574e2a8997337b1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ISgs.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\ISgs.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IYYQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\IYYQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 96304c3f6c49df9ab16bd96ac989aadcb3ec95055f1f69e571ded5a772cec342
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IcIQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\IcIQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3dc767f3a793eb46136f74a634244ed322abd8f11064508e16af650ca7ce7e98
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        IkkK.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\IkkK.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 dc0ef94165ae2de15efd75f3a5e68d71e24a66346d41faf64a99d5e83ba32b48
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KAMK.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\KAMK.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 37d2ec68979cff0f8cf25fc7cbe95ac06ecc623406d149312064fc973daa0385
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KcUk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\KcUk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c1874b7aa94ba433445cda8dbb5c1c69c2d5413a3412c564ec9b3885acbcbd14
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KgwG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\KgwG.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 35db4ea1a38305c3837e07b7b7f90fdb4cb059c3d802e701f75e81ca9c3f8f4a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KkAQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\KkAQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 20524a737bc429f969190dddbe6d43242eeff8fcb2b79426b29c92ae870d7237
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KkEo.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\KkEo.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ba6a40e6dc4887e595ee9ff0769a9b8054655da28b3f83fec8b67beeef586621
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KowU.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\KowU.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        KqIs.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\KqIs.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        MAwQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\MAwQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3ad45fd459aeca61b39e72e5a6e263966ccfef24073d0114429c13796205e428
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        McYQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\McYQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c661fa214819f5f301203dfd9b1085a46af4cd40c32e0ebd98a008e5fd1d2877
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        MssG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\MssG.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d46443ab40b396dc066dbbbffbdea9ee41108c88c6d0e04cbdd2f0650d3417fa
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OAIs.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\OAIs.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 5ac103309ac44444495bc9ed9c798c21437411bb2384ff83d7120ca9a4fe707b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OAky.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\OAky.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 0fc507f35813d54546d9b82846f80f165fd6ed136307e73841b114a627dff53d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OMgY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\OMgY.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ea836b3c5699beec7ae09901212ec21bb0db1c391336ad0380f3a351ada01709
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OUYi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\OUYi.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 9132a9f44a0bc794d6f8f822500d410ea43f79842ffb47899f2d9b049e378437
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        OsMY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\OsMY.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 805637da13dd2043dcf7e0acdcd3aaf2053a060033a9a273d4bdea158712b745
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QEAg.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\QEAg.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 5795718bc7bed08997c9c153ee892b220978ad89aadc81685ac12030debed1d3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QQgM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\QQgM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4b922116c329966d5c6cdedf24efc402ea5528498c2a93ded88cbc32876ccd60
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QUwY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\QUwY.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7fc602672bce60bdbe97a23c016f17a35e9b50a5f39721ccbed4572d40f2ba6f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QkgE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\QkgE.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6dd188111e760f29b1b2f709b7335afb81fc1868fa3c5ba7b72dc9bc32972c45
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        QoQY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\QoQY.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 264da51272bff0627b59c76c571e5f8e9065d605fa14083162a04c758a5d4e9d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SEcw.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SEcw.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 14ba5b12b507ed4c9398dbb42fb6cad19a42afc76fc1429805b1dd82921f5295
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SskQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SskQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.4MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e19ae985bedb942e3f543619448d8086f0ff3becf6b17b08de5c95640d163288
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        SwQs.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SwQs.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.4MB
                                                                                                                                                                                                                                                                                                                        • SHA256 849f7dda49836bca7684e2f25dca02c043ec9d989befbb9fdc2fd31b5e8d1c29
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UIgo.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\UIgo.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 9a288cf2106d59c30e345ba3da8b7753fac5b490a2947104ffe5783bd75b1fe4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UIsy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\UIsy.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 54c5971b1d74f6a687fc93c9b400c8cd545985f32a228a2a369365ad9152b217
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UQYG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\UQYG.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                                                                                                        • SHA256 509e405534ab7d2b291e13a07ac17ade52e67e9c7a74b2dd7c72f4e774d7bf30
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UcQk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\UcQk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 31ca605024fdbe1c45b1460673ddc2d7cd2a4cf2ac064d1206c54bdf0e237940
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        UwgI.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\UwgI.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f0db9304102e4930f361c23856edeb473693c357cc114f2f38101dcea4fd4087
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WAwc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\WAwc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 84d535e3e51574042af174e7f425560d98fa9bbca063be12a6a196c2a38bffc3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WIEE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\WIEE.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.4MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6fecfeef0e11463c16b0d709489fdbf230d76d786adc9efdba9d1c0de3eba89b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        WYcs.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\WYcs.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        YiYI.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\YiYI.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        aEsU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\aEsU.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c16ed14c6787e2fa98031fe0e671e07ef1e0d7909ae8f8b1242686d72eca5ded
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        aMUE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\aMUE.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3d2146e9493eb07b46db0cf8fb9e2baa81b236405e57f0a8911620fd7818cdac
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        aQou.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\aQou.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7e2bf9efec198f3c0512d25a54e58eae7ab60317dfe5c2558a63a8bebe41d3bf
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        aawg.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\aawg.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        acQc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\acQc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4ce1d498b5eb4f0c5146f1b9859c826a58799f5268ea507be48a374f44d6f65d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        aogE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\aogE.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 2835a80be0c3c36926397974aa71dd567579431c78d9981181624af07effbd29
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        aosY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\aosY.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f591912e5a5b92c63ed827536652e14a4efac21b56b317c414d3d6c8377b3090
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cAsU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\cAsU.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 eef1b0a9d42a8f05719b1fa9923c3b15be2f340c719dae3079322aa59dd35cbb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cYga.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\cYga.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.4MB
                                                                                                                                                                                                                                                                                                                        • SHA256 dfafe7175e91d06ecaac174fb595636cc3f4546fe429081adbcce00daf127a8b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cksE.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\cksE.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 2c2eccc7c4c7b4db173fe35fe1336227a0de996f39d8e8e750ee1fe65fa76340
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        coke.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\coke.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 df46fe2f16607fd646d5fc5d6cc75abadfae5ccb4b0f5c0ba085b662c91591bf
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        cuos.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\cuos.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eAIu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\eAIu.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 713ed9a415fd3aadadac4da190b3cddacff40f93458b21ec0d4b489795b1cc2a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eAkS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\eAkS.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 273985bdcce7e036142090e62232aa763670ca8e28c9883c53fb0430de4de51d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eIUI.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\eIUI.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eQMG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\eQMG.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 9d64de0e8e075e6e0472fc4a24d29bcd243818a0f19b55df9e197e300ffa18f7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ecgk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\ecgk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 dc42260d98366ed0b00e67637a2ee7d57467b5da6676c6a006a8ceb361ebd6be
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        eokS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\eokS.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 281684e7fc8bb66027b70c3cd89b1fe07d151b618b9d14af589de27972daa822
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ewgq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\ewgq.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 dcdcb63301c4b4b4a13372b2b53a8830951e4a51934247f1184fc932154a2fe4
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gYAe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\gYAe.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 86b2fc1b8de5a8da6e82512a839ce20bc13b7079a9a7de48bcec5a33b8c54002
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gcgQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\gcgQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 91ebed4bdd30e27d3a84f130933bf26186df18bbf878f8245ad375b86231a476
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        gsEC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\gsEC.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4ee52da11e9418af7f2999b1e6ad53ac2d1d84166e049aa6240c1a62414d9fbb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        iEkI.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\iEkI.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 927d57b5c1fb7627eb2762552a18eb3033419240f9585069420456f200690362
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        iUoU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\iUoU.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 cfe784c405a280ccd2fd1ca96a719dab46bf06dc36ef3f01ed5d82ab50daf000
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        iUwK.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\iUwK.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 bee49f3458c81adbb1c2727a28f245327ca7011333e8ec965cd0f81a3b549714
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ioIa.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\ioIa.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 a2db5103239a9523704102ca05a6454728ee643585f7b97e0552240146f276a0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        iwIW.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\iwIW.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1b6b23e1fc1bb70b9fa52059404790ce1cc2f90dcd195a50e5710dfce3eebd66
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kEoS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\kEoS.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6ced930d3160da9d3d309e1083aa559b02bb31ad12c5393dab1b1a60debf4410
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kIUc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\kIUc.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.4MB
                                                                                                                                                                                                                                                                                                                        • SHA256 9fb79f1f0557dc0afb536ad06b8776463311a57d35ea49110edc7b0c7701590a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kIse.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\kIse.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 39f017fefb278a63668833cafafe844a9c40c773f7c2ca0405f2d67c07c3903b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kQIy.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\kQIy.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 76f43358d3848cf8a3a6288b47e8e979fdc0af01ec72a5b410ab0b1a48896d6b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kQoM.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\kQoM.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 448de06d1319ebeffdb6bb54af4cab8f454d98bb2fbf6416cb3d4edc18b5a285
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kUMG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\kUMG.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b49cd06fcd101c44af2a9538db341a5f7710b4ea87aca336f0cda9e866025e4b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kUMK.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\kUMK.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 338fd3ce9bcf2baf5fb4e31e9a2d4b2c0e68890394d67882257630edd7c8937f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        koUU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\koUU.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 84d6ce6fe13239dbbb8d7844ee0a764d3bc1d2d0d96d6850dbb8519f8a3eb584
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        kwgk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\kwgk.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8316676eee2bf43276e9d63992158b39a6b52d9577dce3c5d19cbb166235eb02
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mQgo.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\mQgo.exe
                                                                                                                                                                                                                                                                                                                        • Size 3.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 4ddaa314be4e8162379d3d325db95fa01a9bb62c19bbbe55a7a061b12310ec76
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mgIm.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\mgIm.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                                                                                                        • SHA256 9622cc19916e8c33a5d5d2f502c0c32ceac953fd11ee70d875e4960f75a356a7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        mgwi.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\mgwi.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 5b7d42b330d3808ccba8979beb98ddf0a638cb0a04d06ea76d41ab9a28004e27
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        oQAS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\oQAS.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 497e0e6705cf0f5bc38bb23ac247c763c470c86cec5dd58a5e80e6e138c3a4cf
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        oUUc.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\oUUc.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6fb46c8d4c1b0793fbe4dbefb38c2912bcaf89ce73480612f58a901061de6a28
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ogca.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\ogca.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b1a58805e23a3892256c9a5e73880d4b6bf480e344d1a885b1d7edb6aef56bb1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qEMA.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\qEMA.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        qgIu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\qgIu.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 819aa22ef9575c6340d7b1e19f9937e75b36247d7e84740d1b4f0fd037a74e1d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sAUY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\sAUY.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 51f58f3deef300c50e1d89ec937b41c110efa4b0b3b825809f7499bb26b23864
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sEoA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\sEoA.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 f589372b477552ed9c06da09f87caed0e2e9204198a45682f4f1283af89af0cf
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sksu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\sksu.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 44d219899a1c9f409a9aebe83a55207ff4e905e0d435a782094a293897d2e563
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        sskq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\sskq.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 05d9116aff9284dc3a8603dd9a9647ff260b4853a09b17535027139308a58ca7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        uAQA.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\uAQA.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 2901cfc304d981d4cd0d7552a1304a5c99d9c22a6a2ce1a81ecec666afe94f71
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        uAgW.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\uAgW.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 bfc18905dc4cfc23a56a686a000c2d896813af1b7df699321a0ef5d06bc0b604
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        uAgg.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\uAgg.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 0c4c7a8bba3b276e3f5488862e08a2879c0167406fe1189ebf97411f6c59aa41
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        uEoG.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\uEoG.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e4cf75e06224259cd102d41db4bd268eba9ec50c54d4f43f7913eac096b0f3f1
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        uEsg.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\uEsg.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c4314206e588a678fc5399c9086a6c5b59452fbcfa944aed67d91f48194b79ed
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        uUwu.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\uUwu.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d2d2a0173a9564960d79b7016231bc81bbe1042503582db89e01365ac89149e8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ucYo.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\ucYo.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 ad7ab5f4a6acaded3aa9595ed6b8b3e56e85cb7ac9b26ddb1d8d88bfd897a3e9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        usUa.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\usUa.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 742f1c04ed2dd38a00be4f455e7ca1084488105f61e172d0dab2c709408a06cd
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        uwcS.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\uwcS.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 27d71a14ad00a24c61f3268f2a2a3895259f2961d11462836f6a7b2c6812e6c3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wEAk.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\wEAk.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 93f5a8a485cffbf39017ab06eb13f7940d1327de863e749c40f14895667fc375
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wEEO.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\wEEO.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.4MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d5a12069d9b47529a50904bdc11c46492dd52a83c0e3ad129a25444fb2f3197e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wMYW.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\wMYW.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7a4c71b6c336e9c02b831dc2dd745ad8d3fc92b3eeae5942677a8a5666db1381
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wQoY.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\wQoY.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 81fbbce66cdd91ed240f8bbd52a376664ddf59db8c1e4a3ff5b278b7ea7b2692
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        weUs.ico
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\weUs.ico
                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                        • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wgkW.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\wgkW.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c72ff1e82a6efdfa98f624e8400f38b064318912bbb33fee0d2d6687bae3d4cd
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wgsQ.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\wgsQ.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 af4dccc8e9f0a1bf6c5077d0d3a87ffdb9681b381078dce74c829d1869a97acf
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wscC.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\wscC.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 7cd744b23a434723f82297e086f5f7da2029540702e9ab617ca50834cf4cd999
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        wsog.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\wsog.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1aaafbcff5728ac1a67fa47e0d1830dacf10f0020674717f0ef05404c1104d1b
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yMMU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\yMMU.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 3cca3de09ff2e10235f9ed15131c9c9c639992e0cf3ff79cb99f16a7283eab23
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yQQo.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\yQQo.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 819347200da564cc279e5074231a0d917091b7412ed279837c5983b2a0eab6cf
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        yYYU.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\yYYU.exe
                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 a50d3ab1dc470000848d4b7807d5415a7a5306614658357df724562c1be3b744
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        ysAq.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\ysAq.exe
                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                        • SHA256 d08de73ca8c5462f00896d13019e6ef34d6ee3325a7d4cb6a7debac0067d3001
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        memory/260-171-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/568-1863-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/820-424-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/820-515-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/868-1832-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/896-1886-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/928-1814-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1048-1720-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1116-1917-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1160-65-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1312-1957-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1368-1751-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1372-95-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1824-1966-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1848-156-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1976-2162-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1976-21-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1996-33-0x0000000002340000-0x0000000002360000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1996-0-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1996-32-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1996-1-0x0000000002340000-0x0000000002360000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2000-2176-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2112-1738-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2172-200-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2256-1979-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2324-2167-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2352-1729-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2400-139-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2400-121-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2444-1854-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2540-214-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2548-46-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2720-137-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2720-129-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2928-140-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3000-1254-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3132-319-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3132-273-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3144-1783-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3172-1761-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3172-1752-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3284-1895-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3284-1882-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3404-1948-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3424-138-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3424-118-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3436-429-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3460-1770-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3616-108-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3616-91-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3780-1149-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3804-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3804-2152-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4224-186-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4280-122-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4280-135-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4616-1908-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4808-1823-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4812-1999-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4832-2010-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4852-81-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5040-1792-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5080-1935-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5172-1400-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5172-1306-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5408-130-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5520-1988-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5696-1841-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5708-1092-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5728-1926-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5860-18-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5860-2157-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5884-1876-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5944-261-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5944-222-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6072-226-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6140-1801-0x0000000000400000-0x00000000005B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download