Overview

overview

10

Static

static

3

2026-09-24...ck.exe

windows10-2004-x64

5

2026-09-24...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 08:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
  • Size 1.6MB
  • Sample260925-j9jsfatblg
  • SHA256 414cc16a69d0c22c2ace74fc077e8d2271581316804354e618e0e3d4daefe5d6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 29 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 29 IoCs
    defense_evasiontrojan
  • Renames multiple (105) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 29 IoCs
    execution
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 58 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5800
    • C:\Users\Admin\iAAQYQQc\RaYEMIIo.exe
      "C:\Users\Admin\iAAQYQQc\RaYEMIIo.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2356
    • C:\ProgramData\DEookoUY\pSMYcYAA.exe
      "C:\ProgramData\DEookoUY\pSMYcYAA.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:1108
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3924
      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1064
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:244
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            5⤵
              PID:120
            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
              C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1336
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                6⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:8
                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                  C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:3356
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                    8⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:1116
                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                      C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                      9⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:2716
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                        10⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:3324
                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                          C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                          11⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:2648
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                            12⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:1368
                            • C:\Windows\System32\Conhost.exe
                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              13⤵
                                PID:6040
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                13⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:1328
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                  14⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:2052
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                    15⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4552
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                      16⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:1984
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                        17⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:2824
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                          18⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:2828
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                            19⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1960
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                              20⤵
                                              • Executes a command shell one-liner
                                              PID:4152
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                21⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1976
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                  22⤵
                                                  • Executes a command shell one-liner
                                                  PID:5140
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                    23⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4796
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                      24⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3204
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                        25⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2884
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                          26⤵
                                                          • Executes a command shell one-liner
                                                          PID:2584
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                            27⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:5976
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                              28⤵
                                                              • Executes a command shell one-liner
                                                              PID:4920
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                                29⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:3020
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                                  30⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:4888
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                                    31⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:6100
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                                      32⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:2216
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                                        33⤵
                                                                          PID:2612
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                                            34⤵
                                                                            • Executes a command shell one-liner
                                                                            PID:5752
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                                              35⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3360
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                                                36⤵
                                                                                • Executes a command shell one-liner
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1912
                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                                                  37⤵
                                                                                    PID:5784
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                                                      38⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:5996
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                                                        39⤵
                                                                                          PID:1408
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                                                            40⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:1120
                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                                                              41⤵
                                                                                                PID:1584
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                                                                  42⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2676
                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                    43⤵
                                                                                                      PID:5300
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                                                                      43⤵
                                                                                                        PID:4892
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                                                                          44⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          PID:3528
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                                                                            45⤵
                                                                                                              PID:3768
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                                                                                46⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:2632
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                                                                                  47⤵
                                                                                                                    PID:1384
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                                                                                      48⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:2012
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                                                                                        49⤵
                                                                                                                          PID:2440
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                                                                                            50⤵
                                                                                                                            • Executes a command shell one-liner
                                                                                                                            PID:4660
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                                                                                              51⤵
                                                                                                                                PID:1800
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                                                                                                  52⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:4720
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                                                                                                    53⤵
                                                                                                                                      PID:4372
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                                                                                                        54⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:5492
                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          55⤵
                                                                                                                                            PID:2244
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                                                                                                            55⤵
                                                                                                                                              PID:5932
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                                                                                                                56⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:5848
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                                                                                                                  57⤵
                                                                                                                                                    PID:2680
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock"
                                                                                                                                                      58⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4576
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                      58⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:2280
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                      58⤵
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:2928
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                      58⤵
                                                                                                                                                      • UAC bypass
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:948
                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                        59⤵
                                                                                                                                                          PID:4568
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cccMsUQY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                                                                        58⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:2628
                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                          59⤵
                                                                                                                                                            PID:1812
                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                            59⤵
                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                            PID:3816
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                      56⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:4292
                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                        57⤵
                                                                                                                                                          PID:2136
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                        56⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        • Modifies registry key
                                                                                                                                                        PID:2272
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                        56⤵
                                                                                                                                                        • UAC bypass
                                                                                                                                                        • Modifies registry key
                                                                                                                                                        PID:1548
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lkUcIQMc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                                                                        56⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:5132
                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                          57⤵
                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                          PID:248
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                    54⤵
                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:4964
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                    54⤵
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:5544
                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      55⤵
                                                                                                                                                        PID:848
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                      54⤵
                                                                                                                                                      • UAC bypass
                                                                                                                                                      PID:2324
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iqAsUIQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                                                                      54⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:252
                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                        55⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        PID:3364
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                  52⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:4180
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                  52⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:1812
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                  52⤵
                                                                                                                                                  • UAC bypass
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:3908
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JWowgUIM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                                                                  52⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:5884
                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                    53⤵
                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4696
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                              50⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:2136
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                              50⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1476
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                              50⤵
                                                                                                                                              • UAC bypass
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:5576
                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                51⤵
                                                                                                                                                  PID:1088
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OMUkkYoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                                                                50⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:5888
                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  51⤵
                                                                                                                                                    PID:3744
                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                    51⤵
                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                    PID:5948
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                              48⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:2064
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                              48⤵
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:3584
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                              48⤵
                                                                                                                                              • UAC bypass
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:2480
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PuQsMkIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                                                              48⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:5512
                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                49⤵
                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4976
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                          46⤵
                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                          PID:5416
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                          46⤵
                                                                                                                                          • Modifies registry key
                                                                                                                                          PID:3300
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                          46⤵
                                                                                                                                          • UAC bypass
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:4824
                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                            47⤵
                                                                                                                                              PID:1400
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DCgswsEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                                                            46⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:704
                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                              47⤵
                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                              PID:4980
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                        44⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:944
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                        44⤵
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:3552
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                        44⤵
                                                                                                                                        • UAC bypass
                                                                                                                                        PID:4800
                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          45⤵
                                                                                                                                            PID:1364
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EoAEIMUY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                                                          44⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:2360
                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                            45⤵
                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                            PID:2492
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                      42⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:848
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                      42⤵
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:2480
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                      42⤵
                                                                                                                                      • UAC bypass
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2064
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ucIIogEE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                                                      42⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:5016
                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                        43⤵
                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                        PID:2244
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                  40⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:4732
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                  40⤵
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:5516
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                  40⤵
                                                                                                                                  • UAC bypass
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:3256
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AgEsQkMk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                                                  40⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:5084
                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                    41⤵
                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                    PID:2912
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                              38⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              PID:568
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                              38⤵
                                                                                                                              • Modifies registry key
                                                                                                                              PID:1684
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                              38⤵
                                                                                                                              • UAC bypass
                                                                                                                              PID:1568
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PwwMoUYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                                              38⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:4344
                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                39⤵
                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                PID:6072
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                          36⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          • Modifies registry key
                                                                                                                          PID:2156
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                          36⤵
                                                                                                                            PID:2752
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                            36⤵
                                                                                                                            • UAC bypass
                                                                                                                            • Modifies registry key
                                                                                                                            PID:4260
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KGIYkkck.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                                            36⤵
                                                                                                                            • Executes a command shell one-liner
                                                                                                                            PID:5116
                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                              37⤵
                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                              PID:2616
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                        34⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        PID:1408
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                        34⤵
                                                                                                                        • Modifies registry key
                                                                                                                        PID:1088
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                        34⤵
                                                                                                                        • UAC bypass
                                                                                                                        • Modifies registry key
                                                                                                                        PID:4624
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LGEgokEY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                                        34⤵
                                                                                                                        • Executes a command shell one-liner
                                                                                                                        PID:3292
                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                          35⤵
                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:5408
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                    32⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    • Modifies registry key
                                                                                                                    PID:2244
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                    32⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Modifies registry key
                                                                                                                    PID:1972
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                    32⤵
                                                                                                                    • UAC bypass
                                                                                                                    • Modifies registry key
                                                                                                                    PID:2508
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VoUQwYgI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                                    32⤵
                                                                                                                    • Executes a command shell one-liner
                                                                                                                    PID:2292
                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                      33⤵
                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                      PID:4608
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                30⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                PID:5332
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                30⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Modifies registry key
                                                                                                                PID:5236
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                30⤵
                                                                                                                • UAC bypass
                                                                                                                • Modifies registry key
                                                                                                                PID:5896
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XugMAckE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                                30⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:1876
                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                  31⤵
                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                  PID:5500
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                            28⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Modifies registry key
                                                                                                            PID:1364
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                            28⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:5300
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                            28⤵
                                                                                                            • UAC bypass
                                                                                                            • Modifies registry key
                                                                                                            PID:848
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uKEIMMkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                            28⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            PID:5144
                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                              29⤵
                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                              PID:2324
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                        26⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • Modifies registry key
                                                                                                        PID:5284
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                        26⤵
                                                                                                          PID:4568
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                          26⤵
                                                                                                          • UAC bypass
                                                                                                          • Modifies registry key
                                                                                                          PID:3744
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GMwkwokI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                          26⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:120
                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                            27⤵
                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                            PID:2112
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                      24⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      • Modifies registry key
                                                                                                      PID:4628
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                      24⤵
                                                                                                      • Modifies registry key
                                                                                                      PID:6040
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                      24⤵
                                                                                                      • UAC bypass
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Modifies registry key
                                                                                                      PID:5656
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ROMgEksM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                      24⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      PID:5860
                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                        25⤵
                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:2764
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                  22⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies registry key
                                                                                                  PID:2976
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                  22⤵
                                                                                                    PID:1836
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                    22⤵
                                                                                                    • UAC bypass
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Modifies registry key
                                                                                                    PID:3900
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Rkossoko.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                    22⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    PID:6136
                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                      23⤵
                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                      PID:2632
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                20⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Modifies registry key
                                                                                                PID:6100
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                20⤵
                                                                                                  PID:5936
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                  20⤵
                                                                                                  • UAC bypass
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies registry key
                                                                                                  PID:200
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zwgUYUUw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                  20⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:3260
                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                    21⤵
                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                    PID:1400
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                              18⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Modifies registry key
                                                                                              PID:468
                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                19⤵
                                                                                                  PID:3020
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                18⤵
                                                                                                • Modifies registry key
                                                                                                PID:1924
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                18⤵
                                                                                                • UAC bypass
                                                                                                • Modifies registry key
                                                                                                PID:4320
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ySwUwYQo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                                18⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:1156
                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                  19⤵
                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                  PID:5664
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                            16⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Modifies registry key
                                                                                            PID:4412
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                            16⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2272
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                            16⤵
                                                                                            • UAC bypass
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Modifies registry key
                                                                                            PID:4300
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ckgUUsUE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                            16⤵
                                                                                            • Executes a command shell one-liner
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5368
                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                              17⤵
                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2300
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                        14⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry key
                                                                                        PID:1476
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                        14⤵
                                                                                        • Modifies registry key
                                                                                        PID:4616
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                        14⤵
                                                                                        • UAC bypass
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry key
                                                                                        PID:5756
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gYQoUAoc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                        14⤵
                                                                                        • Executes a command shell one-liner
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1244
                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                          15⤵
                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:4732
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                    12⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Modifies registry key
                                                                                    PID:6028
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                    12⤵
                                                                                    • Modifies registry key
                                                                                    PID:5908
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                    12⤵
                                                                                    • UAC bypass
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Modifies registry key
                                                                                    PID:4700
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZocIggIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                    12⤵
                                                                                    • Executes a command shell one-liner
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4940
                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                      13⤵
                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                      PID:976
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                10⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Modifies registry key
                                                                                PID:480
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                10⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:4084
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                10⤵
                                                                                • UAC bypass
                                                                                • Modifies registry key
                                                                                PID:2612
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lcAIwMsw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                                10⤵
                                                                                • Executes a command shell one-liner
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3716
                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                  11⤵
                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:5888
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Modifies registry key
                                                                            PID:1432
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                            8⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry key
                                                                            PID:5168
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                            8⤵
                                                                            • UAC bypass
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1384
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FqwMEEcg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                            8⤵
                                                                            • Executes a command shell one-liner
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:6076
                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                              9⤵
                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                              PID:200
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                        6⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5300
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                        6⤵
                                                                        • Modifies registry key
                                                                        PID:4664
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                        6⤵
                                                                        • UAC bypass
                                                                        PID:6008
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DswkcEss.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                        6⤵
                                                                        • Executes a command shell one-liner
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1496
                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                          7⤵
                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                          PID:5784
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                    4⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry key
                                                                    PID:5716
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                    4⤵
                                                                    • Modifies registry key
                                                                    PID:428
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                    4⤵
                                                                    • UAC bypass
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry key
                                                                    PID:5132
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IKgcsMgE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                    4⤵
                                                                    • Executes a command shell one-liner
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1844
                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                      5⤵
                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                      PID:2160
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                2⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Modifies registry key
                                                                PID:5000
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                2⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4932
                                                                • C:\Windows\System32\Conhost.exe
                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  3⤵
                                                                    PID:5752
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                  2⤵
                                                                  • UAC bypass
                                                                  • Modifies registry key
                                                                  PID:1836
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wGsAUYIE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock.exe""
                                                                  2⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3676
                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                    3⤵
                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                    PID:5808
                                                              • C:\ProgramData\SGUQIwYk\CIgwockw.exe
                                                                C:\ProgramData\SGUQIwYk\CIgwockw.exe
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • Drops file in System32 directory
                                                                PID:4604
                                                              • C:\ProgramData\DEookoUY\pSMYcYAA.exe
                                                                C:\ProgramData\DEookoUY\pSMYcYAA.exe
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1372
                                                              • C:\Users\Admin\iAAQYQQc\RaYEMIIo.exe
                                                                C:\Users\Admin\iAAQYQQc\RaYEMIIo.exe
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of FindShellTrayWindow
                                                                PID:4072

                                                              Network

                                                                    MITRE ATT&CK Enterprise v16

                                                                    Reconnaissance

                                                                    Resource Development

                                                                    Initial Access

                                                                    Execution

                                                                    Command and Scripting Interpreter

                                                                    2
                                                                    T1059

                                                                    Visual Basic

                                                                    1
                                                                    T1059.005

                                                                    Windows Command Shell

                                                                    1
                                                                    T1059.003

                                                                    Persistence

                                                                    Boot or Logon Autostart Execution

                                                                    1
                                                                    T1547

                                                                    Registry Run Keys / Startup Folder

                                                                    1
                                                                    T1547.001

                                                                    Privilege Escalation

                                                                    Abuse Elevation Control Mechanism

                                                                    1
                                                                    T1548

                                                                    Bypass User Account Control

                                                                    1
                                                                    T1548.002

                                                                    Boot or Logon Autostart Execution

                                                                    1
                                                                    T1547

                                                                    Registry Run Keys / Startup Folder

                                                                    1
                                                                    T1547.001

                                                                    Defense Evasion

                                                                    Abuse Elevation Control Mechanism

                                                                    1
                                                                    T1548

                                                                    Bypass User Account Control

                                                                    1
                                                                    T1548.002

                                                                    Hide Artifacts

                                                                    1
                                                                    T1564

                                                                    Hidden Files and Directories

                                                                    1
                                                                    T1564.001

                                                                    Impair Defenses

                                                                    1
                                                                    T1562

                                                                    Disable or Modify Tools

                                                                    1
                                                                    T1562.001

                                                                    Modify Registry

                                                                    4
                                                                    T1112

                                                                    Credential Access

                                                                    Credentials from Password Stores

                                                                    1
                                                                    T1555

                                                                    Credentials from Web Browsers

                                                                    1
                                                                    T1555.003

                                                                    Unsecured Credentials

                                                                    1
                                                                    T1552

                                                                    Credentials In Files

                                                                    1
                                                                    T1552.001

                                                                    Discovery

                                                                    System Information Discovery

                                                                    1
                                                                    T1082

                                                                    System Location Discovery

                                                                    1
                                                                    T1614

                                                                    System Language Discovery

                                                                    1
                                                                    T1614.001

                                                                    Lateral Movement

                                                                    Collection

                                                                    Data from Local System

                                                                    1
                                                                    T1005

                                                                    Command and Control

                                                                    Exfiltration

                                                                    Impact

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    pSMYcYAA.exe
                                                                    • Path C:\ProgramData\DEookoUY\pSMYcYAA.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 5642c91503a83bd35bbe267649abc317906feb1efaa9bfbc1b35dafc7432bd60
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    pSMYcYAA.inf
                                                                    • Path C:\ProgramData\DEookoUY\pSMYcYAA.inf
                                                                    • Size 4B
                                                                    • SHA256 4a5a17798d05b1ec53efb54ee9c7fbdbd04153611635ac21c61e1230d7baca44
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    pSMYcYAA.inf
                                                                    • Path C:\ProgramData\DEookoUY\pSMYcYAA.inf
                                                                    • Size 4B
                                                                    • SHA256 af250dde7580a36a83b348c8b20b95f79cd1c00414db9b7d3db9cb7492a5d808
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    CIgwockw.exe
                                                                    • Path C:\ProgramData\SGUQIwYk\CIgwockw.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 d82657c45bd3fe84baa144088a4cc635b4f363f1cbbb6ad3658686717f3073bf
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    eWUQ.txt
                                                                    • Path C:\ProgramData\eWUQ.txt
                                                                    • Size 8KB
                                                                    • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_655c174450ab5ab9d5e0e2733bc70c7a_elex_virlock
                                                                    • Size 5KB
                                                                    • SHA256 98817a572430813ca4ca2787dab20573f7864c5168ac6912f34d14b49e7bd7c9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    IKgcsMgE.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IKgcsMgE.bat
                                                                    • Size 112B
                                                                    • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    file.vbs
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                    • Size 19B
                                                                    • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    RaYEMIIo.exe
                                                                    • Path C:\Users\Admin\iAAQYQQc\RaYEMIIo.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 7f6f6c1decead2b1cba0876fe636d34031fc36adbebd6abb33cebd1260d90187
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    RaYEMIIo.inf
                                                                    • Path C:\Users\Admin\iAAQYQQc\RaYEMIIo.inf
                                                                    • Size 4B
                                                                    • SHA256 7633506584dca7e9716727fe44b549a28d9f7ee5d6d66e248e9e03b65324ee05
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    RaYEMIIo.inf
                                                                    • Path C:\Users\Admin\iAAQYQQc\RaYEMIIo.inf
                                                                    • Size 4B
                                                                    • SHA256 b7ce9602e7b0136d2e9f2bcfca484730e36d9f31837a5e77df627754fe74b796
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    ASsE.ico
                                                                    • Path C:\Windows\ASsE.ico
                                                                    • Size 4KB
                                                                    • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    AUcQ.exe
                                                                    • Path C:\Windows\AUcQ.exe
                                                                    • Size 2.0MB
                                                                    • SHA256 c0527db90caacce4bde6db9ae7999fb58b7910f4a53633e5bafde7b99843d4b5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    AYkG.exe
                                                                    • Path C:\Windows\AYkG.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 5347d123bdd866df9e7416c67380f167c0351b3ececb6f8abc22c3e21f7b8379
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    AkEY.exe
                                                                    • Path C:\Windows\AkEY.exe
                                                                    • Size 2.4MB
                                                                    • SHA256 139f41a28e03746f4309690c9042986ce0c3cba052a114f05d64e6fc21b0ce50
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    AoUy.exe
                                                                    • Path C:\Windows\AoUy.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 b874e2fa5722f5509b0b0b916f94d674e6cd324485a5f2ecc25e4d3e4b266d3c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    CAwO.exe
                                                                    • Path C:\Windows\CAwO.exe
                                                                    • Size 1.8MB
                                                                    • SHA256 a6ccd9f7f4e62a9c10feeb624929f968fc3ff207c43fa3f7d9cfed389753b0e1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    CYkm.exe
                                                                    • Path C:\Windows\CYkm.exe
                                                                    • Size 2.1MB
                                                                    • SHA256 d5c0bc9adc43c275122ba6a5455e65b9457654572e410f66e7c8aaf88c69bebf
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    CssW.exe
                                                                    • Path C:\Windows\CssW.exe
                                                                    • Size 1.9MB
                                                                    • SHA256 8652339e89d28a0e2f9bccfd5ff4b37858983c2ae0f4c1fd424706a5002dc00b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Cswc.exe
                                                                    • Path C:\Windows\Cswc.exe
                                                                    • Size 2.0MB
                                                                    • SHA256 a9a8ff67f8ca067e710ee1a621cd3888a3310437f5bb2b954d9fb9a72c8a3a9d
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    EQoU.exe
                                                                    • Path C:\Windows\EQoU.exe
                                                                    • Size 1.8MB
                                                                    • SHA256 38d056b0b5502526a7430119bd61e921ba8e7eeb55dd04fa17da504be4e1362b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    EQwu.exe
                                                                    • Path C:\Windows\EQwu.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 5ad83785bb2ac16025ed9e61a44d2cbdf845963e5dc92412ce30a47c6321edd4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    EcQk.exe
                                                                    • Path C:\Windows\EcQk.exe
                                                                    • Size 2.4MB
                                                                    • SHA256 7ec62da76a96a7d0e620b73f736dc0373a5f4aac53ffc799458ef38aaf9736c1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    EgUG.exe
                                                                    • Path C:\Windows\EgUG.exe
                                                                    • Size 2.4MB
                                                                    • SHA256 076b18ca19c2f330177d869452fba332bd8568d197f5339d0468d2c326e684a0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    EsYI.exe
                                                                    • Path C:\Windows\EsYI.exe
                                                                    • Size 1.8MB
                                                                    • SHA256 1f29fd3597ef23ac085845881ec4c753a7c9ea9aaef525631249d40e493ba402
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    GUMA.exe
                                                                    • Path C:\Windows\GUMA.exe
                                                                    • Size 1.9MB
                                                                    • SHA256 c3e7d857cc0ff7689a722c9d9d1ac4d1546b9eb7992206e9e69df69da698583a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    GcES.exe
                                                                    • Path C:\Windows\GcES.exe
                                                                    • Size 1.8MB
                                                                    • SHA256 48cddae8b4e00ff8227bb01b164acc391ac75ba81aa2dad28caa3f5cad1c5211
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    GwoA.ico
                                                                    • Path C:\Windows\GwoA.ico
                                                                    • Size 4KB
                                                                    • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    KEEe.exe
                                                                    • Path C:\Windows\KEEe.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 b249fb42b2d63344040b78a93736f89e05f578fac298e1368c9234180bb90876
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    KIEW.exe
                                                                    • Path C:\Windows\KIEW.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 49f4eeeaf9f1594f2a1fe6823d505287c869993d2ef1565084b75633e5314870
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    KUcm.exe
                                                                    • Path C:\Windows\KUcm.exe
                                                                    • Size 3.1MB
                                                                    • SHA256 bab0c77e258e80a53aa4b402762ec270a4c1f59329f0418f1fead4bea62aebc6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    KYQu.exe
                                                                    • Path C:\Windows\KYQu.exe
                                                                    • Size 1.7MB
                                                                    • SHA256 952fd48f96fd1a7b49b024f5ac8798cf165ad8b4c7c33e72829650811af4af1b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    KYks.exe
                                                                    • Path C:\Windows\KYks.exe
                                                                    • Size 2.5MB
                                                                    • SHA256 4af0af909fcd34e05d1a7d846e3bc8d2e3ab1593f0bc2a032a7daf6e7d237010
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    KkAu.exe
                                                                    • Path C:\Windows\KkAu.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 a359be3412328b51eef681d31e1c1b8d93f4cc17b3d9cdc7678f379393d4726c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    MAEq.exe
                                                                    • Path C:\Windows\MAEq.exe
                                                                    • Size 2.0MB
                                                                    • SHA256 c1f493feccb9168068643ba6d07acf37b33a3919f19727d1a135772e57ca0d60
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    MMMQ.exe
                                                                    • Path C:\Windows\MMMQ.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 a2807b6cb7aea906b161d68f4bf8f83b93834f815c742797679a883f86b54c65
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    MMoA.exe
                                                                    • Path C:\Windows\MMoA.exe
                                                                    • Size 2.9MB
                                                                    • SHA256 5741aeb19d8004a3a3692705dc65a39ae3dfa7647d1ede59e3527ffb6fc13832
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    OIUC.exe
                                                                    • Path C:\Windows\OIUC.exe
                                                                    • Size 1.8MB
                                                                    • SHA256 18ade41b6df1f00c9efa38ae1be70dccfd9b54eecfe27db6179e976b7bc3fbf2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    OIwC.exe
                                                                    • Path C:\Windows\OIwC.exe
                                                                    • Size 1.7MB
                                                                    • SHA256 59de8e3dea3261b8c79d7260bf2cdd141b327b651b23f81793ccd6bc7cdf3ff9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    OUMo.exe
                                                                    • Path C:\Windows\OUMo.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 be7757c9bfa32b64258f136ba395b7a66157ca180b2e64cf2f9ceefcd2cdea70
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    OYEk.exe
                                                                    • Path C:\Windows\OYEk.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 078cf076698d73998b58769c050a76453dbf5c10fd005c894f3df85d95e13e52
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    OckK.exe
                                                                    • Path C:\Windows\OckK.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 e21872ec0b4fdba7787f62f8f19bcf4062c011f7c4fd450c7bfb48da7ff2c762
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    OkoS.exe
                                                                    • Path C:\Windows\OkoS.exe
                                                                    • Size 1.8MB
                                                                    • SHA256 21b0d4a2f9e5a7a8b1849d558b108e4ff294a16f50e2b76a0bf63d056f217442
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    OkwG.exe
                                                                    • Path C:\Windows\OkwG.exe
                                                                    • Size 1.9MB
                                                                    • SHA256 0814e224a3f5cc7fbbc4ad80c51f726981275ef1dbbb10379d1d37e7d1109563
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    OsQs.exe
                                                                    • Path C:\Windows\OsQs.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 e7cb0f350278fc6766fb1227c9071270866aaa4c3c7781ea81a139a9ed44bdd5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    QGok.ico
                                                                    • Path C:\Windows\QGok.ico
                                                                    • Size 4KB
                                                                    • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    QMES.exe
                                                                    • Path C:\Windows\QMES.exe
                                                                    • Size 2.7MB
                                                                    • SHA256 e9252195ce407c79e83fbc4d489cabd6298e92484247ea71ddcf3a0f1385bf14
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    QcEY.exe
                                                                    • Path C:\Windows\QcEY.exe
                                                                    • Size 1.7MB
                                                                    • SHA256 c11b484d22c45cc839dc8caa01e8e924752f1ee8afdbb73f2e7e415708a91911
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    QsgO.exe
                                                                    • Path C:\Windows\QsgO.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 9f5fc08fc0c853fd094ba40cb704584494a7266e680304f3d10364d1fd30fbd2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    QswO.exe
                                                                    • Path C:\Windows\QswO.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 9ee85b38144d8eba7e8286409068b1cbeaa6a8c290bb9c704ddd62e04fe249b5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    QswQ.exe
                                                                    • Path C:\Windows\QswQ.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 e790b098967fd499d4ca85efdd9080b5628875bdd169ff04f3ed7b5349908260
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    QwUA.exe
                                                                    • Path C:\Windows\QwUA.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 493c0a813ba2cbd03770fee284deb3adf984ad1a9b4bb3c1b25beb7637c85713
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SAgI.exe
                                                                    • Path C:\Windows\SAgI.exe
                                                                    • Size 2.1MB
                                                                    • SHA256 1fca3d84871ea0584b7154b91b7aec7142e156bd0ea32361e2d41b5f481a2785
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SYUY.exe
                                                                    • Path C:\Windows\SYUY.exe
                                                                    • Size 1.9MB
                                                                    • SHA256 b4b3bac7d126263062df0ae09bcbf057b663c47542a1d3b10449c219bba8d98f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SYkc.exe
                                                                    • Path C:\Windows\SYkc.exe
                                                                    • Size 1.8MB
                                                                    • SHA256 15270fffc9da04f35c7555aa6a9c01350c5140ef69797ad510c4282f8b9171f6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ScAK.exe
                                                                    • Path C:\Windows\ScAK.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 68141b88ccc76f4b83e52d5b775e0176201c262699c728f47e9fda6b21f6bb3b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Scok.exe
                                                                    • Path C:\Windows\Scok.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 84429f63c1c5ef0aa9a7214643c1b0c470c3ca51c67e587256f61b0d2ca1e14f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SkwM.exe
                                                                    • Path C:\Windows\SkwM.exe
                                                                    • Size 2.1MB
                                                                    • SHA256 0c740d9ac6ca5cc0f4e4ad3531689c97de19e4b7f9fdf003a48120ae6b023274
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Skwu.exe
                                                                    • Path C:\Windows\Skwu.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 b54d162c7470349803a2a7dc5bcdb989d0cba4305521781d5d944ca64f69cc09
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    UIgS.exe
                                                                    • Path C:\Windows\UIgS.exe
                                                                    • Size 1.7MB
                                                                    • SHA256 b4bf8371ed1d25479f414882b8b16a87db9ed2086be5f85bd5aad4626ac8f567
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    UQIk.exe
                                                                    • Path C:\Windows\UQIk.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 fa49eac18688794a001ad3c86b343fa94040d010cfbb15c9ff5e843832fe8b7e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    UgQo.exe
                                                                    • Path C:\Windows\UgQo.exe
                                                                    • Size 1.7MB
                                                                    • SHA256 d6168542648dcc467c03e6557d70fd2d7f909ef37203a5f7cb1c0fc1a94b20ef
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    UwIW.exe
                                                                    • Path C:\Windows\UwIW.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 f5d26584fd9a8c63ec8c55c61d64bb05b535be4ac7934bff113a4151dcf16518
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    WIky.exe
                                                                    • Path C:\Windows\WIky.exe
                                                                    • Size 1.8MB
                                                                    • SHA256 640720d897c38f7d9a01c0e0982adcd0ef6b7cb5360f9ffab69dbde32d592e0e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    WMkI.exe
                                                                    • Path C:\Windows\WMkI.exe
                                                                    • Size 2.3MB
                                                                    • SHA256 b11161562266d49a2ddb0ff2c8b074f96513ed1c639bc15791d513a9cbeba69c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    WgQO.exe
                                                                    • Path C:\Windows\WgQO.exe
                                                                    • Size 2.0MB
                                                                    • SHA256 443088483192e8337972d4b93ec1b100b4f2bb3c64c7c0f7ba039bc2d9686528
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    WkQY.ico
                                                                    • Path C:\Windows\WkQY.ico
                                                                    • Size 4KB
                                                                    • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Wqgs.ico
                                                                    • Path C:\Windows\Wqgs.ico
                                                                    • Size 4KB
                                                                    • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    YcUW.exe
                                                                    • Path C:\Windows\YcUW.exe
                                                                    • Size 1.9MB
                                                                    • SHA256 7dd3d1f0ffaacd21337a689b3ab90a175640ea8681687ab68534553ba4d4a3aa
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    YkEw.exe
                                                                    • Path C:\Windows\YkEw.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 f91e037708d6b80059f4ac10b1062d07658c03b150e7ec280f6cc6232ac42974
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    aUIC.exe
                                                                    • Path C:\Windows\aUIC.exe
                                                                    • Size 2.0MB
                                                                    • SHA256 83b3bcbacbe1cc569d245f75ee1c18ced6544f48dc7843607b1526032d581508
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    aYUY.exe
                                                                    • Path C:\Windows\aYUY.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 804fca429126aed1424bba15a6b1c31452beced86e33e105e7606eba93505d4d
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    aksC.exe
                                                                    • Path C:\Windows\aksC.exe
                                                                    • Size 2.0MB
                                                                    • SHA256 599a0748e58250ea466581f1d4da733e2b4d831117bbef1f534e9ef3f2adeed3
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    amEk.ico
                                                                    • Path C:\Windows\amEk.ico
                                                                    • Size 4KB
                                                                    • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ascM.exe
                                                                    • Path C:\Windows\ascM.exe
                                                                    • Size 2.2MB
                                                                    • SHA256 eaf1e0ebd59c85a5c94a9e082b922f03b4ac169baee9fefff292293942626637
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    askI.exe
                                                                    • Path C:\Windows\askI.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 0c686094ab18ce638a82881f61fa3a8e2e1c6eb554bc333802a744a46d96e84c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    awsk.exe
                                                                    • Path C:\Windows\awsk.exe
                                                                    • Size 2.1MB
                                                                    • SHA256 2e9dad0231767283f15a6ea38348f844eb5375416098094a827a9d6503148463
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    cEIQ.exe
                                                                    • Path C:\Windows\cEIQ.exe
                                                                    • Size 2.1MB
                                                                    • SHA256 566853a34bf9b8808112f500bff32d5672fa7c13052edf385583587cf173369a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    cIEQ.exe
                                                                    • Path C:\Windows\cIEQ.exe
                                                                    • Size 2.0MB
                                                                    • SHA256 01a3b88daced885ced8a573fb0091e0346de9c4c0c8e47ac19b2b63d491ca004
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    cUgY.exe
                                                                    • Path C:\Windows\cUgY.exe
                                                                    • Size 1.9MB
                                                                    • SHA256 864b700b122bf464bd6f28c48a78697e8166f9745e3d9ab6ad66c36c4c7ab320
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    cYEk.exe
                                                                    • Path C:\Windows\cYEk.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 13a41c174cd76fb3b210fc8108c83aebad04b2f3c9521f4680f65d5cdccb51a6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    cYwY.exe
                                                                    • Path C:\Windows\cYwY.exe
                                                                    • Size 2.5MB
                                                                    • SHA256 17c8e87f33baec059b47bc2967216634f71ac05e89fe0e52efecf81c6bccf4b6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ckUu.exe
                                                                    • Path C:\Windows\ckUu.exe
                                                                    • Size 1.8MB
                                                                    • SHA256 200fcf928cd66ad06028825ab77625976cde88930899a8f650b671b89c7db51f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    cwEO.exe
                                                                    • Path C:\Windows\cwEO.exe
                                                                    • Size 1.7MB
                                                                    • SHA256 8cd2cd37df512f9d4570d3d28a7cf90762ec8179584ad4c75158136e07fdc421
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    eMMe.exe
                                                                    • Path C:\Windows\eMMe.exe
                                                                    • Size 1.9MB
                                                                    • SHA256 a2e958c851b5511ea92b9c4fc59f821ba0d516ec20fab0b88a3f6b7d76ed0f5c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    eQEA.exe
                                                                    • Path C:\Windows\eQEA.exe
                                                                    • Size 1.7MB
                                                                    • SHA256 21bbd24dce01cece4b57262c7f0b2093d81fb39f2948743fa6b0bf981e3ff105
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    eQcO.exe
                                                                    • Path C:\Windows\eQcO.exe
                                                                    • Size 2.1MB
                                                                    • SHA256 1cbad02561bdacae4767d25e21021f7e202aebbdbb2b556e6c2babab6ca0c62e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ecUe.exe
                                                                    • Path C:\Windows\ecUe.exe
                                                                    • Size 1.9MB
                                                                    • SHA256 ceb9913c73af1c4aba4ac9e79e7cdbec02783797858fbd23301facd307f11e3b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    egIY.exe
                                                                    • Path C:\Windows\egIY.exe
                                                                    • Size 2.0MB
                                                                    • SHA256 ad48544bb6b39260941a16472c96c1e74e2af8ef1b7c3c58236d6c5fc0d050f9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ekYs.exe
                                                                    • Path C:\Windows\ekYs.exe
                                                                    • Size 2.1MB
                                                                    • SHA256 75b17ac71680407efa11ce32d30949b7a31ef4f64a4bc15bb73305aa347d3f56
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ewsS.exe
                                                                    • Path C:\Windows\ewsS.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 b8b03846022ac08060b189f581498e0261b0a08c1f95b651d58a571047ee4c58
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    gAYO.exe
                                                                    • Path C:\Windows\gAYO.exe
                                                                    • Size 2.2MB
                                                                    • SHA256 09a775899842e1ecdba6ad9185af977b8c3f17ee2987e29afde848f169dc1d39
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    gAgq.exe
                                                                    • Path C:\Windows\gAgq.exe
                                                                    • Size 1.7MB
                                                                    • SHA256 0bb774bd8048d0994d9badcc203dc6154eea8ddcc4d339a2ca511df479338fb8
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    gUQM.exe
                                                                    • Path C:\Windows\gUQM.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 dda84c1ff8b49bd4f12770370d7efaad7c4557bd49873612e29151c13ce0f240
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    gcQC.exe
                                                                    • Path C:\Windows\gcQC.exe
                                                                    • Size 1.9MB
                                                                    • SHA256 1a762e0b110605818f8bddc888246ff2c0642d259a6ce0571fea8df0c8225c94
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    gkwa.exe
                                                                    • Path C:\Windows\gkwa.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 25e48dcdc13736c9a0e386826b206b7c88ac88192ddaed87de379547285ca818
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    icIm.exe
                                                                    • Path C:\Windows\icIm.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 12dc6bf42276284284a47e32a7ca2c65c42b0f35c81d94792ec2a21191637e02
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ioUa.exe
                                                                    • Path C:\Windows\ioUa.exe
                                                                    • Size 2.2MB
                                                                    • SHA256 cb46162da836e98c247aa4f384ac15e37a7bdfacd67f39ce28f6755535ddcb08
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    iswq.exe
                                                                    • Path C:\Windows\iswq.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 92d39207f334cfe4458116532ac172b53c918b46201280cc4f34e1e0a74ca016
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    iwYU.exe
                                                                    • Path C:\Windows\iwYU.exe
                                                                    • Size 1.8MB
                                                                    • SHA256 a020b1bb40f9eb5f8aa76f4dc0f2e62c5cb48fb31107f82ffb93e684e68df105
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    kQsm.exe
                                                                    • Path C:\Windows\kQsm.exe
                                                                    • Size 1.7MB
                                                                    • SHA256 9d200186d75132c192e7d5a86ffd7282e5b9170b720dbf3df826be98b6dcf072
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    kogQ.exe
                                                                    • Path C:\Windows\kogQ.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 a19036ca9fa797136af19738952fb8a2ac441c6a701217c1248ac5ba3f382467
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    mAAM.exe
                                                                    • Path C:\Windows\mAAM.exe
                                                                    • Size 1.8MB
                                                                    • SHA256 b44827755c0fe1e8b435b99da7a5fbd2feeb30f72de1ad3c4a23bbb9e4768100
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    mIck.exe
                                                                    • Path C:\Windows\mIck.exe
                                                                    • Size 2.4MB
                                                                    • SHA256 4ffb53bc78c00b286d34dadd778052b18ad3545f764b5ed184c4f0513040e2d3
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    mcEu.exe
                                                                    • Path C:\Windows\mcEu.exe
                                                                    • Size 1.7MB
                                                                    • SHA256 26052176fcadf26a689e5070d6a86c6985a044e5508330228de5e89590319de1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    mkwC.exe
                                                                    • Path C:\Windows\mkwC.exe
                                                                    • Size 1.7MB
                                                                    • SHA256 40c68eeb9612d5f41036c06057e3a07797a53eb857ebfccb4878d6025fd78363
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    mmMw.ico
                                                                    • Path C:\Windows\mmMw.ico
                                                                    • Size 4KB
                                                                    • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    moQK.exe
                                                                    • Path C:\Windows\moQK.exe
                                                                    • Size 2.2MB
                                                                    • SHA256 d26926d067677b487f8fe49931d59a7c36125e02a50d2c9b677b83e0aaf1582a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    mosw.exe
                                                                    • Path C:\Windows\mosw.exe
                                                                    • Size 2.3MB
                                                                    • SHA256 adbba385d3889c5139e2518f6e925497cd295e7324d5561da9dc46dc620fc9bc
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    mwcg.ico
                                                                    • Path C:\Windows\mwcg.ico
                                                                    • Size 4KB
                                                                    • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    oIAi.exe
                                                                    • Path C:\Windows\oIAi.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 c046b45fc491dd09797ea4ce5e22e34751575aad75b1341de06077258b2e5d98
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    oMse.exe
                                                                    • Path C:\Windows\oMse.exe
                                                                    • Size 2.6MB
                                                                    • SHA256 d1c8fb5831715a312dd34eb176cec5444af0ebb1960af94c4abd8a602f655511
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ocQi.exe
                                                                    • Path C:\Windows\ocQi.exe
                                                                    • Size 1.7MB
                                                                    • SHA256 b55b311462258f2b41887694f6c8dc110b56faad557b76ca9949e77da52a89d4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    osgq.exe
                                                                    • Path C:\Windows\osgq.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 9d3e93a5e83da3127aa3523f92676c90022f7716964ea48241059eab12b973bb
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    qAcu.exe
                                                                    • Path C:\Windows\qAcu.exe
                                                                    • Size 1.9MB
                                                                    • SHA256 5024f12ad9c4b08f0eb2b77a597d417ac0f5c532425d1a32d9be872b344c8987
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    qIwc.exe
                                                                    • Path C:\Windows\qIwc.exe
                                                                    • Size 2.0MB
                                                                    • SHA256 5ceb98e2e0062cacc8cae6894408f611d65dadb9ff9bd2f40bf6c23995f18fdc
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    qMEy.exe
                                                                    • Path C:\Windows\qMEy.exe
                                                                    • Size 1.9MB
                                                                    • SHA256 fa04f5d0d2f89fcbd73c98b1a57d3dc7eb2fcffac0977476134cb49a659886f1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    qYwU.exe
                                                                    • Path C:\Windows\qYwU.exe
                                                                    • Size 2.1MB
                                                                    • SHA256 13bedde256a0739c9b233fc57064d762836bab28763b478f4839a74048269fb0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    qcMk.exe
                                                                    • Path C:\Windows\qcMk.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 f7ee3efb9426617e111fdd74c39b238e1bcc93ff2963b33a0063f29118597c6b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    qogs.exe
                                                                    • Path C:\Windows\qogs.exe
                                                                    • Size 2.0MB
                                                                    • SHA256 4a8b3b5ef02b7b005458cdcbcd64bd08e5d15d1fc2454c5e16e18e579051cc7f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    qwkG.exe
                                                                    • Path C:\Windows\qwkG.exe
                                                                    • Size 1.7MB
                                                                    • SHA256 256fa58abc4078fc73ab7f6320ae19c461330ce0ddb99e4b9ec3bef62cebd2c0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    sQIC.exe
                                                                    • Path C:\Windows\sQIC.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 e8f8e0905ea306099d32f465ee2650c83188fdfb8bc61dba2d182e72ce521559
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    sQwK.exe
                                                                    • Path C:\Windows\sQwK.exe
                                                                    • Size 2.2MB
                                                                    • SHA256 34eeca44d183e1e26606ec0c8e5b2fd821005bc6fef1d893fd3193df71a3f239
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    scsS.exe
                                                                    • Path C:\Windows\scsS.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 6385365692343f27889f21ffd6edc8333edaea5d11470c94730f05a66b089bdf
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    smks.ico
                                                                    • Path C:\Windows\smks.ico
                                                                    • Size 4KB
                                                                    • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    uAkw.ico
                                                                    • Path C:\Windows\uAkw.ico
                                                                    • Size 4KB
                                                                    • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    uIwA.exe
                                                                    • Path C:\Windows\uIwA.exe
                                                                    • Size 2.0MB
                                                                    • SHA256 e5958edce6450d45a3155ff15973e5b5d2be74f13e5ceb29960a27fa396d4fe5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    uMAs.ico
                                                                    • Path C:\Windows\uMAs.ico
                                                                    • Size 4KB
                                                                    • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    uYAc.exe
                                                                    • Path C:\Windows\uYAc.exe
                                                                    • Size 2.3MB
                                                                    • SHA256 6ba1719907773d9fc10ed72394c555e374a9e305324889d63713b04bf4537613
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    uYME.exe
                                                                    • Path C:\Windows\uYME.exe
                                                                    • Size 2.2MB
                                                                    • SHA256 df30096c3b7b13bca8986170ee557ff3da2998a4f698c5cc774f35edb46f8156
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    uwgs.exe
                                                                    • Path C:\Windows\uwgs.exe
                                                                    • Size 2.6MB
                                                                    • SHA256 10a2b0095bc9d76f6d682e321e7d0a833b669442fabfdfdbeebbd72af211156b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    wEww.exe
                                                                    • Path C:\Windows\wEww.exe
                                                                    • Size 2.4MB
                                                                    • SHA256 286eac08daea19a721335caabd696b21ed8bb0409197cb3e9ea636bed80038bd
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    wIMu.exe
                                                                    • Path C:\Windows\wIMu.exe
                                                                    • Size 1.9MB
                                                                    • SHA256 b0655ca831f6ed91ac79d1f01cecfbaeb3234986c8d6e71a681f4042841f5137
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    wgYS.exe
                                                                    • Path C:\Windows\wgYS.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 27764fb035c802a6be370903671d552bc33300350eeeae3607c2e5ec0fdf4cd2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    wsom.exe
                                                                    • Path C:\Windows\wsom.exe
                                                                    • Size 2.7MB
                                                                    • SHA256 9b815433497089e25dab47fcc4feff2864278a04835db47ef83cad6ce8db72be
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    yQom.exe
                                                                    • Path C:\Windows\yQom.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 afb0f920e470b970732896921ac1a49324c61dde6a0e1f6250ff34141f9c93fc
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ykEy.exe
                                                                    • Path C:\Windows\ykEy.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 143fa3a20e7ddb5953376c61523f67f5e3bc1fea6f8467dc3d60b6a970150ab5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ykog.exe
                                                                    • Path C:\Windows\ykog.exe
                                                                    • Size 2.2MB
                                                                    • SHA256 51a475398e6f61979c66b9f277d4dee7043de1656a98f914436238880586312d
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ywIs.exe
                                                                    • Path C:\Windows\ywIs.exe
                                                                    • Size 1.6MB
                                                                    • SHA256 05a3ac7c718473b23e02618e650b9aad0eddda2088e4b4ef57dca21f63bc1b3b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ywYa.exe
                                                                    • Path C:\Windows\ywYa.exe
                                                                    • Size 1.7MB
                                                                    • SHA256 7edbde04dfb9b1a66405fc017d37bce4ac88722c8445bb13cb1a6789777612a2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    memory/1064-50-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/1108-17-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                    Download

                                                                    memory/1108-2020-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                    Download

                                                                    memory/1328-122-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/1336-65-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/1372-2030-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                    Download

                                                                    memory/1384-828-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/1384-764-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/1408-601-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/1584-660-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/1800-983-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/1960-168-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/1960-150-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/1976-184-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/2356-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                    Download

                                                                    memory/2356-2015-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                    Download

                                                                    memory/2440-874-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/2612-269-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/2648-90-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/2648-110-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/2680-1174-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/2716-94-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/2824-154-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/2884-215-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/3020-238-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/3356-79-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/3360-381-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/3768-2131-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/4072-2035-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                    Download

                                                                    memory/4372-1043-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/4552-118-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/4552-139-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/4604-2025-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                    Download

                                                                    memory/4604-20-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                    Download

                                                                    memory/4796-200-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/4892-696-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/5784-485-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/5800-0-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/5800-1-0x00000000007B0000-0x00000000007D0000-memory.dmp
                                                                    Download

                                                                    memory/5800-34-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/5800-35-0x00000000007B0000-0x00000000007D0000-memory.dmp
                                                                    Download

                                                                    memory/5932-1115-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/5976-227-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download

                                                                    memory/6100-248-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                    Download