Overview

overview

10

Static

static

3

2026-09-29...ck.exe

windows10-2004-x64

10

2026-09-29...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 02:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
  • Size 1.6MB
  • Sample260930-cmjqlavs2p
  • SHA256 81939d603c75ad4559a3f8ff5c150f9b7de6242ac999c503acb416ac2a51a0a2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 20 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 20 IoCs
    defense_evasiontrojan
  • Renames multiple (123) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 20 IoCs
    execution
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 40 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 60 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Users\Admin\VcYocQkg\KIYkYMIE.exe
      "C:\Users\Admin\VcYocQkg\KIYkYMIE.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      PID:2476
    • C:\ProgramData\hWcgUQgM\qEAkUMgI.exe
      "C:\ProgramData\hWcgUQgM\qEAkUMgI.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:2296
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5248
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3248
          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1212
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3120
              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5000
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1084
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2516
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4640
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:5936
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2816
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4376
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:5424
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:1116
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:5472
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:3568
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:3076
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3536
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          PID:2056
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1936
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
                                              22⤵
                                              • Executes a command shell one-liner
                                              PID:3084
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                                                23⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4140
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4800
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                                                    25⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:5412
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      PID:5012
                                                      • C:\Windows\System32\Conhost.exe
                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        27⤵
                                                          PID:1404
                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
                                                          C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                                                          27⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1308
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
                                                            28⤵
                                                            • Executes a command shell one-liner
                                                            PID:1036
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
                                                              C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                                                              29⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:2924
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
                                                                30⤵
                                                                • Executes a command shell one-liner
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3040
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                                                                  31⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:2672
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
                                                                    32⤵
                                                                    • Executes a command shell one-liner
                                                                    PID:5704
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                                                                      33⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3440
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
                                                                        34⤵
                                                                        • Executes a command shell one-liner
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:6100
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                                                                          35⤵
                                                                            PID:5872
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
                                                                              36⤵
                                                                              • Executes a command shell one-liner
                                                                              PID:2636
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                                                                                37⤵
                                                                                  PID:2060
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
                                                                                    38⤵
                                                                                    • Executes a command shell one-liner
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1704
                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                      39⤵
                                                                                        PID:3572
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                                                                                        39⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:4516
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock"
                                                                                          40⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:4308
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                          40⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • Modifies registry key
                                                                                          PID:3352
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                          40⤵
                                                                                          • Modifies registry key
                                                                                          PID:5508
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                          40⤵
                                                                                          • UAC bypass
                                                                                          • Modifies registry key
                                                                                          PID:5952
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ESUAYgow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                                                                                          40⤵
                                                                                          • Executes a command shell one-liner
                                                                                          PID:6040
                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                            41⤵
                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:1436
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                      38⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies registry key
                                                                                      PID:5916
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                      38⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies registry key
                                                                                      PID:3780
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                      38⤵
                                                                                      • UAC bypass
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies registry key
                                                                                      PID:2980
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VMQMIckM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                                                                                      38⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3888
                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                        39⤵
                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                        PID:4188
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                  36⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies registry key
                                                                                  PID:2936
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                  36⤵
                                                                                  • Modifies registry key
                                                                                  PID:1548
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                  36⤵
                                                                                  • UAC bypass
                                                                                  • Modifies registry key
                                                                                  PID:4100
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sgEMwgQo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                                                                                  36⤵
                                                                                  • Executes a command shell one-liner
                                                                                  PID:4680
                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                    37⤵
                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                    PID:756
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                              34⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Modifies registry key
                                                                              PID:1156
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                              34⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry key
                                                                              PID:5576
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                              34⤵
                                                                              • UAC bypass
                                                                              • Modifies registry key
                                                                              PID:2732
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kmEUkogI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                                                                              34⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5984
                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                35⤵
                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                PID:1504
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                          32⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Modifies registry key
                                                                          PID:1392
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                          32⤵
                                                                          • Modifies registry key
                                                                          PID:5508
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                          32⤵
                                                                          • UAC bypass
                                                                          • Modifies registry key
                                                                          PID:5056
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sQsUcEYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                                                                          32⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2684
                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                            33⤵
                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1868
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                      30⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry key
                                                                      PID:3484
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                      30⤵
                                                                      • Modifies registry key
                                                                      PID:2132
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        31⤵
                                                                          PID:428
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                        30⤵
                                                                        • UAC bypass
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry key
                                                                        PID:2064
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DkwQMgow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                                                                        30⤵
                                                                        • Executes a command shell one-liner
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2960
                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                          31⤵
                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2084
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                    28⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Modifies registry key
                                                                    PID:1992
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                    28⤵
                                                                    • Modifies registry key
                                                                    PID:2400
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                    28⤵
                                                                    • UAC bypass
                                                                    • Modifies registry key
                                                                    PID:2788
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PcoUUEEE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                                                                    28⤵
                                                                    • Executes a command shell one-liner
                                                                    PID:6036
                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                      29⤵
                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2500
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                26⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Modifies registry key
                                                                PID:1944
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                26⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry key
                                                                PID:3272
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                26⤵
                                                                • UAC bypass
                                                                • Modifies registry key
                                                                PID:2872
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmYwIUAs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                                                                26⤵
                                                                • Executes a command shell one-liner
                                                                PID:5136
                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                  27⤵
                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2264
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                            24⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Modifies registry key
                                                            PID:5792
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                            24⤵
                                                            • Modifies registry key
                                                            PID:5344
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                            24⤵
                                                            • UAC bypass
                                                            • Modifies registry key
                                                            PID:2504
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OWEIYMgk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                                                            24⤵
                                                            • Executes a command shell one-liner
                                                            PID:5196
                                                            • C:\Windows\SysWOW64\cscript.exe
                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                              25⤵
                                                              • Executes a VBScript file via the Windows Script Host.
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1784
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                        22⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Modifies registry key
                                                        PID:2732
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                        22⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry key
                                                        PID:5992
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                        22⤵
                                                        • UAC bypass
                                                        • Modifies registry key
                                                        PID:5576
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GwQYokwU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                                                        22⤵
                                                        • Executes a command shell one-liner
                                                        PID:2608
                                                        • C:\Windows\SysWOW64\cscript.exe
                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                          23⤵
                                                          • Executes a VBScript file via the Windows Script Host.
                                                          PID:2588
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                    20⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Modifies registry key
                                                    PID:4380
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                    20⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry key
                                                    PID:5244
                                                    • C:\Windows\System32\Conhost.exe
                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      21⤵
                                                        PID:1560
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                      20⤵
                                                      • UAC bypass
                                                      • Modifies registry key
                                                      PID:1248
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WigYMAMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                                                      20⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2436
                                                      • C:\Windows\SysWOW64\cscript.exe
                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                        21⤵
                                                        • Executes a VBScript file via the Windows Script Host.
                                                        PID:4728
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                  18⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:428
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                  18⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:5024
                                                  • C:\Windows\System32\Conhost.exe
                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    19⤵
                                                      PID:964
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                    18⤵
                                                    • UAC bypass
                                                    • Modifies registry key
                                                    PID:1388
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vSoQIQcA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                                                    18⤵
                                                    • Executes a command shell one-liner
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5064
                                                    • C:\Windows\SysWOW64\cscript.exe
                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                      19⤵
                                                      • Executes a VBScript file via the Windows Script Host.
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5392
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                16⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry key
                                                PID:4828
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                16⤵
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry key
                                                PID:856
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                16⤵
                                                • UAC bypass
                                                • Modifies registry key
                                                PID:2400
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DeMAkkEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                                                16⤵
                                                • Executes a command shell one-liner
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:4316
                                                • C:\Windows\SysWOW64\cscript.exe
                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                  17⤵
                                                  • Executes a VBScript file via the Windows Script Host.
                                                  PID:2500
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                            14⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Modifies registry key
                                            PID:3572
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                            14⤵
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry key
                                            PID:1404
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                            14⤵
                                            • UAC bypass
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry key
                                            PID:2872
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nYAIEcMc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                                            14⤵
                                            • Executes a command shell one-liner
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:1240
                                            • C:\Windows\SysWOW64\cscript.exe
                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                              15⤵
                                              • Executes a VBScript file via the Windows Script Host.
                                              PID:3000
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                        12⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry key
                                        PID:5776
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                        12⤵
                                        • Modifies registry key
                                        PID:4332
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                        12⤵
                                        • UAC bypass
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry key
                                        PID:4088
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xgwMUscU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                                        12⤵
                                        • Executes a command shell one-liner
                                        • Suspicious use of WriteProcessMemory
                                        PID:5736
                                        • C:\Windows\SysWOW64\cscript.exe
                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                          13⤵
                                          • Executes a VBScript file via the Windows Script Host.
                                          PID:5080
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                    10⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Modifies registry key
                                    PID:5004
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                    10⤵
                                    • Modifies registry key
                                    PID:1504
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                    10⤵
                                    • UAC bypass
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry key
                                    PID:1152
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ecAYcgsU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                                    10⤵
                                    • Executes a command shell one-liner
                                    • Suspicious use of WriteProcessMemory
                                    PID:3268
                                    • C:\Windows\SysWOW64\cscript.exe
                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                      11⤵
                                      • Executes a VBScript file via the Windows Script Host.
                                      PID:5060
                              • C:\Windows\SysWOW64\reg.exe
                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Modifies registry key
                                PID:3200
                              • C:\Windows\SysWOW64\reg.exe
                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                8⤵
                                • Modifies registry key
                                PID:1560
                              • C:\Windows\SysWOW64\reg.exe
                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                8⤵
                                • UAC bypass
                                • System Location Discovery: System Language Discovery
                                • Modifies registry key
                                PID:3348
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cQgkgYgw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                                8⤵
                                • Executes a command shell one-liner
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:2424
                                • C:\Windows\SysWOW64\cscript.exe
                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                  9⤵
                                  • Executes a VBScript file via the Windows Script Host.
                                  PID:504
                          • C:\Windows\SysWOW64\reg.exe
                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                            6⤵
                            • Modifies visibility of file extensions in Explorer
                            • System Location Discovery: System Language Discovery
                            • Modifies registry key
                            PID:964
                          • C:\Windows\SysWOW64\reg.exe
                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                            6⤵
                            • Modifies registry key
                            PID:800
                          • C:\Windows\SysWOW64\reg.exe
                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                            6⤵
                            • UAC bypass
                            • Modifies registry key
                            PID:1672
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oiIkIkYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                            6⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:568
                            • C:\Windows\SysWOW64\cscript.exe
                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                              7⤵
                              • Executes a VBScript file via the Windows Script Host.
                              PID:1304
                      • C:\Windows\SysWOW64\reg.exe
                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                        4⤵
                        • Modifies visibility of file extensions in Explorer
                        • Modifies registry key
                        PID:4172
                      • C:\Windows\SysWOW64\reg.exe
                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                        4⤵
                        • System Location Discovery: System Language Discovery
                        • Modifies registry key
                        PID:4316
                      • C:\Windows\SysWOW64\reg.exe
                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                        4⤵
                        • UAC bypass
                        • System Location Discovery: System Language Discovery
                        • Modifies registry key
                        PID:1492
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Nywoowwc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                        4⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:1228
                        • C:\Windows\SysWOW64\cscript.exe
                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                          5⤵
                          • Executes a VBScript file via the Windows Script Host.
                          PID:1200
                  • C:\Windows\SysWOW64\reg.exe
                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                    2⤵
                    • Modifies visibility of file extensions in Explorer
                    • Modifies registry key
                    PID:1468
                  • C:\Windows\SysWOW64\reg.exe
                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                    2⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies registry key
                    PID:5136
                  • C:\Windows\SysWOW64\reg.exe
                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                    2⤵
                    • UAC bypass
                    • System Location Discovery: System Language Discovery
                    • Modifies registry key
                    PID:4100
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aKEAEAMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock.exe""
                    2⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:5592
                    • C:\Windows\SysWOW64\cscript.exe
                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                      3⤵
                      • Executes a VBScript file via the Windows Script Host.
                      • System Location Discovery: System Language Discovery
                      PID:1008
                • C:\ProgramData\RAwYAMgc\IgQcAUYc.exe
                  C:\ProgramData\RAwYAMgc\IgQcAUYc.exe
                  1⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in System32 directory
                  PID:1924
                • C:\ProgramData\hWcgUQgM\qEAkUMgI.exe
                  C:\ProgramData\hWcgUQgM\qEAkUMgI.exe
                  1⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • Drops file in Windows directory
                  • Reads the TCP/IP host and domain name from the registry
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  PID:2160
                • C:\Users\Admin\VcYocQkg\KIYkYMIE.exe
                  C:\Users\Admin\VcYocQkg\KIYkYMIE.exe
                  1⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Reads the TCP/IP host and domain name from the registry
                  • System Location Discovery: System Language Discovery
                  PID:940

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      2
                      T1059

                      Visual Basic

                      1
                      T1059.005

                      Windows Command Shell

                      1
                      T1059.003

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Privilege Escalation

                      Abuse Elevation Control Mechanism

                      1
                      T1548

                      Bypass User Account Control

                      1
                      T1548.002

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Defense Evasion

                      Abuse Elevation Control Mechanism

                      1
                      T1548

                      Bypass User Account Control

                      1
                      T1548.002

                      Hide Artifacts

                      1
                      T1564

                      Hidden Files and Directories

                      1
                      T1564.001

                      Impair Defenses

                      1
                      T1562

                      Disable or Modify Tools

                      1
                      T1562.001

                      Modify Registry

                      4
                      T1112

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Peripheral Device Discovery

                      1
                      T1120

                      Query Registry

                      1
                      T1012

                      System Information Discovery

                      2
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      System Network Configuration Discovery

                      1
                      T1016

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      JygM.txt
                      • Path C:\ProgramData\JygM.txt
                      • Size 8KB
                      • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IgQcAUYc.exe
                      • Path C:\ProgramData\RAwYAMgc\IgQcAUYc.exe
                      • Size 1.6MB
                      • SHA256 9b077c17c6e64a9e938bdbaed9c5d1cd2c940e4a2d950672c7baa5104d950863
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qEAkUMgI.exe
                      • Path C:\ProgramData\hWcgUQgM\qEAkUMgI.exe
                      • Size 1.6MB
                      • SHA256 61e05c87ad427abca95a21eb76b6984aea5a8fd6d65dee06ac4d7b99b4fed8b2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qEAkUMgI.inf
                      • Path C:\ProgramData\hWcgUQgM\qEAkUMgI.inf
                      • Size 4B
                      • SHA256 65dfb7837c318d6a246c9f74fb061dd03ffd0ba69b70516a7a4b05d32d519ec1
                      • MD5 SHA1 SHA512
                      Submit Download

                      qEAkUMgI.inf
                      • Path C:\ProgramData\hWcgUQgM\qEAkUMgI.inf
                      • Size 4B
                      • SHA256 328217dbfac95a65981f894703df5437d1546a6667c24eea364570d636c5c561
                      • MD5 SHA1 SHA512
                      Submit Download

                      qEAkUMgI.inf
                      • Path C:\ProgramData\hWcgUQgM\qEAkUMgI.inf
                      • Size 4B
                      • SHA256 94cfc142ff16b26eedb159018a8ac26094699cc253aebf82a73aec965bfd880f
                      • MD5 SHA1 SHA512
                      Submit Download

                      qEAkUMgI.inf
                      • Path C:\ProgramData\hWcgUQgM\qEAkUMgI.inf
                      • Size 4B
                      • SHA256 404593c86617eafa8635b7b8201ca8ceb2da3f818ce2d0e1d13dfe93edbc5cb1
                      • MD5 SHA1 SHA512
                      Submit Download

                      qEAkUMgI.inf
                      • Path C:\ProgramData\hWcgUQgM\qEAkUMgI.inf
                      • Size 4B
                      • SHA256 8929dc0784478dde9b9a0fb8e7f7e3af1a837dd1ad7afb5b9fbcdc93d2f312c9
                      • MD5 SHA1 SHA512
                      Submit Download

                      2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_45567e4b76f4b724a226064030d45b15_elex_virlock
                      • Size 28KB
                      • SHA256 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      aKEAEAMs.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\aKEAEAMs.bat
                      • Size 112B
                      • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      file.vbs
                      • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                      • Size 19B
                      • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                      • MD5 SHA1 SHA512
                      Submit Download

                      KIYkYMIE.exe
                      • Path C:\Users\Admin\VcYocQkg\KIYkYMIE.exe
                      • Size 1.6MB
                      • SHA256 a7b381f758547e5ffbae35908a08bcded475ad8f70b57606e626f0cb5269c5ad
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AEYI.exe
                      • Path C:\Windows\AEYI.exe
                      • Size 1.6MB
                      • SHA256 48c2554e872f30598a1166bfc5f770156a32511d8b3b6c10f8b3b8f11d01716e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AIEY.exe
                      • Path C:\Windows\AIEY.exe
                      • Size 1.6MB
                      • SHA256 d0b490ed79ab8df267756a761b3cbee050e26f13895d40e5a5fe226c63d0ab51
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AQgG.exe
                      • Path C:\Windows\AQgG.exe
                      • Size 1.9MB
                      • SHA256 546d9bd9513a2d4d3e322136c590ba41ca39f46e57693897dfaa09e5dd16ea93
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Aook.exe
                      • Path C:\Windows\Aook.exe
                      • Size 2.2MB
                      • SHA256 399700d56b21d8848a889aa0e2a33c40cead85c775690240ebe9556528f64faa
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AskA.exe
                      • Path C:\Windows\AskA.exe
                      • Size 1.8MB
                      • SHA256 3fad075216f5048c4c56954f0b070131fc613c1a1eeafff847b34fcc41e2890f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CYoi.exe
                      • Path C:\Windows\CYoi.exe
                      • Size 1.6MB
                      • SHA256 8d487b22cbedf5ece3217e16211f0718a243ac10096390471e4373899077e36c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Cowk.exe
                      • Path C:\Windows\Cowk.exe
                      • Size 1.9MB
                      • SHA256 6978759c2c33c544bf2e03393d3158171b89e183614c9160852c912da57a1b36
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CwQq.exe
                      • Path C:\Windows\CwQq.exe
                      • Size 1.6MB
                      • SHA256 f25cbc579766723080c1a40e88ec18de5af9ed7b482c1483a2fa218c789e2c08
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      EEMK.exe
                      • Path C:\Windows\EEMK.exe
                      • Size 1.9MB
                      • SHA256 65b7465d041b19df6aa57d80cdfb42d62b147b5cfe240e0dcfd306b63c699f37
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      EcsA.exe
                      • Path C:\Windows\EcsA.exe
                      • Size 2.4MB
                      • SHA256 ac44a8ab39d541eecf04bb0dc55e1426d36ab861c3cac231df554da8021a832c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      EgMK.exe
                      • Path C:\Windows\EgMK.exe
                      • Size 2.0MB
                      • SHA256 cd1d9f4e7dec55992e04916e47f4ec71ab14fd2513ab62874f6c9027d4787d11
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      EgMM.exe
                      • Path C:\Windows\EgMM.exe
                      • Size 1.9MB
                      • SHA256 d730ea5f64bd2a271882d138f818606706f903d23c2a13df7c2bad3bc0894c88
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      EkIi.exe
                      • Path C:\Windows\EkIi.exe
                      • Size 1.6MB
                      • SHA256 3e8d7d87e81ebcb096f07547bf20b56e17d83ba3fdf87eaf92a5b7fc6e4fcb1c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Essm.exe
                      • Path C:\Windows\Essm.exe
                      • Size 2.1MB
                      • SHA256 6314ec1976a3bd5b3df62ce303be282035cb24919a3753849603e8ae79dac46f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      GIog.exe
                      • Path C:\Windows\GIog.exe
                      • Size 1.9MB
                      • SHA256 aced8374407decee1d80ff7556b19ca768aa5dcd46b4a766486aa6ddc08928b5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      GUMA.exe
                      • Path C:\Windows\GUMA.exe
                      • Size 2.0MB
                      • SHA256 8fd93a2badf0ea05175d2839a69fa039154f68f93a7e97050204d37db898ef20
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      GckG.exe
                      • Path C:\Windows\GckG.exe
                      • Size 1.6MB
                      • SHA256 39069f9ac3f8d3833e3f2c3edcdcb5aa1bf09f3739b5c9d8c68056dd238090bb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      GsgW.exe
                      • Path C:\Windows\GsgW.exe
                      • Size 1.8MB
                      • SHA256 3670870f395175a8ca1c4f29179d9adba6d337cfb4306b66f3bfa8d6b7721206
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IAIQ.exe
                      • Path C:\Windows\IAIQ.exe
                      • Size 1.6MB
                      • SHA256 1a98da72fc557f8cfdee54e1a7a406f9008f47cce4adec16645efc89867dce7a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IAoQ.exe
                      • Path C:\Windows\IAoQ.exe
                      • Size 1.9MB
                      • SHA256 cf59b4e11646a0c0b9ec35db6bc1999f3881d50f7331fe226addac09fa28f39b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IMks.exe
                      • Path C:\Windows\IMks.exe
                      • Size 1.6MB
                      • SHA256 ae71275733ae6a205a4bd4fc00c1a5e5a03b319e55f1ed5a0193d849e97eb3b4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IUYw.exe
                      • Path C:\Windows\IUYw.exe
                      • Size 1.6MB
                      • SHA256 1d92b2558fee5ec7ee5db49915e1bd81145b66247af2b78eb8d4d7f498c49051
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IUsQ.exe
                      • Path C:\Windows\IUsQ.exe
                      • Size 1.8MB
                      • SHA256 553b196bce1391a8adbe8e5eebc354c4d2bee3b74ad2b2ff08e725f9ea1dd5dd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IYcY.exe
                      • Path C:\Windows\IYcY.exe
                      • Size 2.4MB
                      • SHA256 d3b6a9b4b7befa19bc066979e73e20028ee00aa5a1fba6b6394003cbe555c5e5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IoMY.exe
                      • Path C:\Windows\IoMY.exe
                      • Size 1.6MB
                      • SHA256 78a33527e7694612a1e7a83e2ed52ae774af0549f3ce7485337c1a9d3f334d04
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IskU.exe
                      • Path C:\Windows\IskU.exe
                      • Size 2.1MB
                      • SHA256 f66b2a5029fad157cd8b321fd2cb4c18a5880ed9534007843c27a98b0c7a059c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      KUIw.exe
                      • Path C:\Windows\KUIw.exe
                      • Size 1.6MB
                      • SHA256 682bf142e33a2788fd6af97682e2445354d3d29018cb15b1a69bfb1c4132f736
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      KUYg.exe
                      • Path C:\Windows\KUYg.exe
                      • Size 1.9MB
                      • SHA256 0261d3ae8179e0f2aa61d9d394f8827d9824ae25968ffcf44a3d53feafad8318
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      KUsA.exe
                      • Path C:\Windows\KUsA.exe
                      • Size 1.7MB
                      • SHA256 cb55c1b7438bb9df8aaa75b01d2a274a75d35c01dfb47b33d99ac009b380a454
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Kcka.exe
                      • Path C:\Windows\Kcka.exe
                      • Size 1.6MB
                      • SHA256 2501a7725a6b1842a6be270167f3b0677c311fddb1a920e8c3c06bd330b5a882
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      KgMe.exe
                      • Path C:\Windows\KgMe.exe
                      • Size 1.6MB
                      • SHA256 5631a3269e77696b71db641c4a7a6b306d3ec4a9459a7de81a3784202a9e2aa1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      KkAO.exe
                      • Path C:\Windows\KkAO.exe
                      • Size 2.2MB
                      • SHA256 59488fc8af935f7fc6f5a4aded2cb3e82ede5495738dfac7994e9189eeb80455
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      KokA.exe
                      • Path C:\Windows\KokA.exe
                      • Size 1.9MB
                      • SHA256 f17bc373d1f1ddad482d6922cfef9c3315de1ea560c773e90b0969fe8c36774c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      KskY.exe
                      • Path C:\Windows\KskY.exe
                      • Size 1.6MB
                      • SHA256 4ee48f74dc18b7a95687becc83573f6a500c3f2cf5901c196a4a8145a54625a7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MAIe.exe
                      • Path C:\Windows\MAIe.exe
                      • Size 2.2MB
                      • SHA256 95c0a0693a772aeb8375d841a10bc5b6e21c27a71c3f6da6760d18ac25e86eb0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MMcC.exe
                      • Path C:\Windows\MMcC.exe
                      • Size 1.6MB
                      • SHA256 a331b7953223454b76d34c8a982c0a9e7111e2c56012e6f0b4c912cb2a2e7d71
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MYoQ.exe
                      • Path C:\Windows\MYoQ.exe
                      • Size 1.6MB
                      • SHA256 b4534879f5661b2e8e17d606b3561d9ea6f15f9e526d8893976d34d40c27ab54
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MYsq.exe
                      • Path C:\Windows\MYsq.exe
                      • Size 2.1MB
                      • SHA256 07bb3ec7424c978a20e65eb9efc0eb17dbc73d4b690c7b0e3a654c22e96f9ce9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      McoQ.ico
                      • Path C:\Windows\McoQ.ico
                      • Size 4KB
                      • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MgQk.exe
                      • Path C:\Windows\MgQk.exe
                      • Size 1.6MB
                      • SHA256 66feb0e63c104c66ef5818fa034d44ec10faa01df18864abe8f6e0db60f6676f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Mkos.exe
                      • Path C:\Windows\Mkos.exe
                      • Size 2.1MB
                      • SHA256 92e9aaa74691723ef4659f048e13652bfa6315e113767acca59e407ffcf1b102
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MwAe.exe
                      • Path C:\Windows\MwAe.exe
                      • Size 1.9MB
                      • SHA256 47367feb0c416c0231179aa68877f1a9d8e7ae8673713360538fba811bdc4a67
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OAMC.exe
                      • Path C:\Windows\OAMC.exe
                      • Size 1.9MB
                      • SHA256 dfa649975cd59b160c8f65b6f8946801bdbefd152452585b81ec0f364b136c3f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OAse.exe
                      • Path C:\Windows\OAse.exe
                      • Size 1.9MB
                      • SHA256 122af6f0c42c743e66b5c1c23a39da5930c9f27f1d68f097e866c679cdf5aaa3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OIsk.exe
                      • Path C:\Windows\OIsk.exe
                      • Size 1.6MB
                      • SHA256 cc29eb01fc496de0d2317293b7e4f7ffce6e8ae35f830a2cdd54b19a786ab80b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OkMe.exe
                      • Path C:\Windows\OkMe.exe
                      • Size 2.2MB
                      • SHA256 8e53a68b148bf802e74d0764bc495684c4aa5bb7e097c60a92c3041f68f162fc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Owwi.exe
                      • Path C:\Windows\Owwi.exe
                      • Size 2.3MB
                      • SHA256 577c3be37bd49f28cbabe09f8cf8e3c7752013b8a7362bab981e334e131eaaba
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      QEcs.exe
                      • Path C:\Windows\QEcs.exe
                      • Size 1.8MB
                      • SHA256 538498f0b2342231a4c58a58f96573ab234573bec14322fa70bf35ae90b5fb59
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      QIko.ico
                      • Path C:\Windows\QIko.ico
                      • Size 4KB
                      • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      QYkG.exe
                      • Path C:\Windows\QYkG.exe
                      • Size 2.0MB
                      • SHA256 e69ae063b50fa023b6434408a453e75849c36b4d084e0f7d0a7c3a6df694ee34
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Qscw.exe
                      • Path C:\Windows\Qscw.exe
                      • Size 2.2MB
                      • SHA256 5c7bd206d9e1026143ae93642be2f2078bade56e2e0a758a865b6fbd367cb9e1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SUUs.exe
                      • Path C:\Windows\SUUs.exe
                      • Size 1.6MB
                      • SHA256 d5aac2b2f97a779d7059d7794bc38f57903100fa8bf2c230d404e8a6683555fe
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SUoO.exe
                      • Path C:\Windows\SUoO.exe
                      • Size 1.8MB
                      • SHA256 a015a0753cec569ba1a84eef686fbe7a46579c95c810d9dc8a96f8d287e9fc03
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SasI.ico
                      • Path C:\Windows\SasI.ico
                      • Size 4KB
                      • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SckQ.exe
                      • Path C:\Windows\SckQ.exe
                      • Size 2.0MB
                      • SHA256 de4575e83d00d469c99cb34b97fbb5ffbe09be833f9ddf675b14751bfa841cfe
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SgIw.exe
                      • Path C:\Windows\SgIw.exe
                      • Size 1.8MB
                      • SHA256 3563941575df5b75a08227450e5e495ccf0d47d989209e15f9093e1b2c05ef0d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SgoS.exe
                      • Path C:\Windows\SgoS.exe
                      • Size 2.1MB
                      • SHA256 bc49eadd8e5671ad87958cc6492dbaa631d96759347d068d50d2e767d92a6213
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SsYq.exe
                      • Path C:\Windows\SsYq.exe
                      • Size 2.1MB
                      • SHA256 cf211b37388062fe82725bae5a05aa364c07ed9795096b751bd16ff3ac9bb2f6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UEEA.exe
                      • Path C:\Windows\UEEA.exe
                      • Size 2.0MB
                      • SHA256 1191cdf03ceaa5f10ae98681272f2e3d96b98bb12c0a46e59e85c50c8948b905
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UEsM.exe
                      • Path C:\Windows\UEsM.exe
                      • Size 3.1MB
                      • SHA256 dbf57293151cca499ea9dc85b93a9855ea45df94644dec2a4969286affd80744
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UIAa.exe
                      • Path C:\Windows\UIAa.exe
                      • Size 1.6MB
                      • SHA256 9cb25ea2422ebbfe763d5f23ec3857bb31d490dcf222186fcaf59e565e09d55d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UQUc.exe
                      • Path C:\Windows\UQUc.exe
                      • Size 1.8MB
                      • SHA256 cad0bfcec1e8221851cc66e2d792d980ca1c3abb85c89e3515b8d6eec7ca26b0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UUEM.exe
                      • Path C:\Windows\UUEM.exe
                      • Size 1.6MB
                      • SHA256 0fc58ada85db28dd4f0541719cd183c7dc82e6e79c2bd34960632eb524cd7e29
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UUgi.exe
                      • Path C:\Windows\UUgi.exe
                      • Size 2.0MB
                      • SHA256 2ef76d35fab1cfec3b3b5d9428cd12b6d37534f5f95abf48e5cc0dda59f7c292
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UgIA.exe
                      • Path C:\Windows\UgIA.exe
                      • Size 1.7MB
                      • SHA256 2bf5303d114493203dc1d83a9e5156bd57feecd2a602b0a64431cbd8c3451089
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UsAi.exe
                      • Path C:\Windows\UsAi.exe
                      • Size 1.8MB
                      • SHA256 9ca99f7d38e7d81d1b0d28d5080636eeeaef4552f57e93df746a85b1e63bc0f1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WEMe.exe
                      • Path C:\Windows\WEMe.exe
                      • Size 2.0MB
                      • SHA256 b615dad8a5581866bdd58652d66aee6f7b4165dca87315117ed1df0a7b96becb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WIAU.ico
                      • Path C:\Windows\WIAU.ico
                      • Size 4KB
                      • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WMoG.exe
                      • Path C:\Windows\WMoG.exe
                      • Size 1.8MB
                      • SHA256 5d48bf100204c57ec7d81db551cec6dfa30fede63782cc1a884e97898b73646c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WMom.exe
                      • Path C:\Windows\WMom.exe
                      • Size 2.0MB
                      • SHA256 002776a4d9f9f29f1cc57ab935cbbbf321d798cdd0bd7fdd76c61c9f1e2cf7c6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WMso.exe
                      • Path C:\Windows\WMso.exe
                      • Size 2.2MB
                      • SHA256 90e7381a3f47f95a765f20fe2120e7a38273d8f244db68dbb66ad854a7e468ca
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WQMU.exe
                      • Path C:\Windows\WQMU.exe
                      • Size 1.9MB
                      • SHA256 d6e4de0725b8476a9010d09e352af2c448c1261b9ce160f75da0cf09ae43b2d0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WUIo.exe
                      • Path C:\Windows\WUIo.exe
                      • Size 1.8MB
                      • SHA256 9dbef64eca6ff40893777ed69753387af139ef4465e1363ba6f669ca47c46844
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WcoE.exe
                      • Path C:\Windows\WcoE.exe
                      • Size 1.6MB
                      • SHA256 1d2a005210afc88fc8a2ae798d5bc0b176167a1d541404594a0f45f8bdf346dd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WkAO.exe
                      • Path C:\Windows\WkAO.exe
                      • Size 2.1MB
                      • SHA256 2a872aa32595696504e49bb73535e82bbfa81223b743e8b19e2bf99f148a2ffa
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WowA.exe
                      • Path C:\Windows\WowA.exe
                      • Size 2.1MB
                      • SHA256 d8fb842dbbdeffccbd2d04be7aa40af8892dc900ee44c52f9e10c905eca3433c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WwYU.exe
                      • Path C:\Windows\WwYU.exe
                      • Size 1.6MB
                      • SHA256 1097c5dfe52fe0a6b4fdaa1f759880011fd93ace15303763980cea9b77bb4157
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Wwwi.exe
                      • Path C:\Windows\Wwwi.exe
                      • Size 1.6MB
                      • SHA256 ba432a2bd257ac3ee56397524d0e771711733260cef12698929850da496a61e7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      YAYo.ico
                      • Path C:\Windows\YAYo.ico
                      • Size 4KB
                      • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      YIUi.exe
                      • Path C:\Windows\YIUi.exe
                      • Size 2.2MB
                      • SHA256 9b883b9b7f87297c3fc9caf7e9c69257403d7673a598e8246b9d5d6af724c20f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      YIkG.exe
                      • Path C:\Windows\YIkG.exe
                      • Size 1.9MB
                      • SHA256 b14041f2adce1c0a82240e44ec8f2c783a07a04823ef8115e82154dad26f4abe
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      YUwA.exe
                      • Path C:\Windows\YUwA.exe
                      • Size 1.6MB
                      • SHA256 187a5d343d334c92b1809580cfee76d52c898bf3b5536bc698241f3ade9c7d3c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Ygoo.exe
                      • Path C:\Windows\Ygoo.exe
                      • Size 2.0MB
                      • SHA256 8bb57b849718c09f3dc01ffeaf4d9618adb9fceabbf1edfb44b0cda2e9efef39
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Ygwm.exe
                      • Path C:\Windows\Ygwm.exe
                      • Size 2.0MB
                      • SHA256 29e1abc348ce358df6707be8e2f10b182093dbf2d6a640b483842d3af108a7db
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      YiYI.ico
                      • Path C:\Windows\YiYI.ico
                      • Size 4KB
                      • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      YwEA.exe
                      • Path C:\Windows\YwEA.exe
                      • Size 1.7MB
                      • SHA256 533f45d03495fdf7d548eb750521c0c8d8e3b80f005d915bad07c54a16de72aa
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      YwcO.exe
                      • Path C:\Windows\YwcO.exe
                      • Size 2.2MB
                      • SHA256 23ea5b595c9175a7f19039519bfddcaeb33da0b68efeef9197bdea4602dddcd3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      akws.exe
                      • Path C:\Windows\akws.exe
                      • Size 2.0MB
                      • SHA256 edc444f7a1c0587aee8f61bcb498bd9234ac20db3a67d1f5112a940557c09965
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      aoEW.exe
                      • Path C:\Windows\aoEW.exe
                      • Size 1.7MB
                      • SHA256 037c07187147dd0dcefa40883e975c7ff71138ca84ee26f00cdb0e788de062a2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      awcU.ico
                      • Path C:\Windows\awcU.ico
                      • Size 4KB
                      • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      cAoS.exe
                      • Path C:\Windows\cAoS.exe
                      • Size 1.9MB
                      • SHA256 3c77f7c39a061f3fae4254198ac922dbb3a13207e6f9c7c76a92851217a8ad51
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      cEEs.exe
                      • Path C:\Windows\cEEs.exe
                      • Size 2.2MB
                      • SHA256 d326070b796a8cbda1f7dfc2b115bad4e24131d250d58c597ab8f06a6d73abcc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      cQkw.ico
                      • Path C:\Windows\cQkw.ico
                      • Size 4KB
                      • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      cgEe.exe
                      • Path C:\Windows\cgEe.exe
                      • Size 1.8MB
                      • SHA256 374d870aeb8d4570d36dcc545e18fcbef1a62e231357ef30e8609768e6281e67
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      cwQS.exe
                      • Path C:\Windows\cwQS.exe
                      • Size 1.7MB
                      • SHA256 ce68576cbd0129a436fd4e2bf3b4c859ce679cee46342c156526c3118b0dcf08
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      eMMM.exe
                      • Path C:\Windows\eMMM.exe
                      • Size 2.2MB
                      • SHA256 168d0cf5db1f52306fa220dad5dba6c5acad344c4dca4125719bc9c806e89fb1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      eUgU.exe
                      • Path C:\Windows\eUgU.exe
                      • Size 1.9MB
                      • SHA256 b83c56967ab024f533bc1a45f2106df896e165851c16d956e3d82d2506c65167
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      eYwM.exe
                      • Path C:\Windows\eYwM.exe
                      • Size 2.0MB
                      • SHA256 402e4525c9f9b979a7143fd024509499f8ac9e982fb024620821b95075fca0d3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      eccy.exe
                      • Path C:\Windows\eccy.exe
                      • Size 1.6MB
                      • SHA256 ccc702fc400020b3ae614b7222fab82408c59f3223399008287b8a70512ec87d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      gAgI.exe
                      • Path C:\Windows\gAgI.exe
                      • Size 2.0MB
                      • SHA256 529e2f5bc2cd32f41c5020579deb200360fcfaf118df533cca4f544aba3f9272
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      gIgu.exe
                      • Path C:\Windows\gIgu.exe
                      • Size 1.9MB
                      • SHA256 82c7b288a0de482b6043eb736203abf3bf2f8453514106d58b9e98e428e41e63
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      gkwC.exe
                      • Path C:\Windows\gkwC.exe
                      • Size 1.6MB
                      • SHA256 9b31909de25c4a98fe2203ef67edc8a65af38feff723048ad173a65902819ea4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      iUoC.exe
                      • Path C:\Windows\iUoC.exe
                      • Size 1.8MB
                      • SHA256 475533adae3bd42a0f39ac7dfffe21610c5689b002780fd5ef7991c02eb2b862
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      iUsS.exe
                      • Path C:\Windows\iUsS.exe
                      • Size 2.0MB
                      • SHA256 af213d24fabecfd5520011de97da7e42efdb2993ac17783b4be20d1affd12ff8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      icIG.exe
                      • Path C:\Windows\icIG.exe
                      • Size 1.7MB
                      • SHA256 c1abbbe6b4bfa65a75c9322a67c8359a7647fa7600fa1e29ba347ae2b3fa296a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ikQo.exe
                      • Path C:\Windows\ikQo.exe
                      • Size 1.9MB
                      • SHA256 4c33f638fc479e5085354ba20d307d24ad6dedfa3a740a228bf55d93bcf322f4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kEIM.exe
                      • Path C:\Windows\kEIM.exe
                      • Size 1.8MB
                      • SHA256 6731055b9939d58c9e8222ad0d545ef6cb6505b086fe76134352fc9a33a5ac49
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kQwG.exe
                      • Path C:\Windows\kQwG.exe
                      • Size 1.9MB
                      • SHA256 7ec5c3073058ddac7cba89a78034b573b6f51519a41a3695274e055a9754e97e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kUgy.exe
                      • Path C:\Windows\kUgy.exe
                      • Size 1.6MB
                      • SHA256 4970cad1a476a2c78ac72adaf784511adacd55e32a35f1e8fc77a9c316c87051
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kcAq.exe
                      • Path C:\Windows\kcAq.exe
                      • Size 2.1MB
                      • SHA256 804b38653148aea0ac3f384cf14f1bec1896b71ee68c3b4972cfe29fa3ddaea7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kkAC.exe
                      • Path C:\Windows\kkAC.exe
                      • Size 1.7MB
                      • SHA256 131dce0efdd87056caeb44d685b199b32544958c769e70652a6f3f3390eba9a0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kokM.exe
                      • Path C:\Windows\kokM.exe
                      • Size 2.0MB
                      • SHA256 3b36ea6ffc56385dd74c0090402325c3de1ceb14c3a63b7fcd7defa5a3d18ee8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mEsK.exe
                      • Path C:\Windows\mEsK.exe
                      • Size 1.6MB
                      • SHA256 5d7adeabda6a4946b804d7688a6cd0cd72a77522f6c6b492f863e22c8789d2ac
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mUMC.exe
                      • Path C:\Windows\mUMC.exe
                      • Size 1.6MB
                      • SHA256 d50fc465e4a146065e12048a3971a453ac04978bead831bbe7794177de850dfd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mUcS.exe
                      • Path C:\Windows\mUcS.exe
                      • Size 2.2MB
                      • SHA256 8193b84ce510a3f5cef1d8da75684c46cc09cff40461d5d020562f38b6f3a221
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mYIs.ico
                      • Path C:\Windows\mYIs.ico
                      • Size 4KB
                      • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      msws.exe
                      • Path C:\Windows\msws.exe
                      • Size 2.0MB
                      • SHA256 30ff5530cfc4411ea6897360f587c976bae7379ffe0dd9fc6fb34ca90b5be5da
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      oQgm.exe
                      • Path C:\Windows\oQgm.exe
                      • Size 1.6MB
                      • SHA256 439f649ad06c268a5bc2082c6d41e82d5d369f1a79f6ce04b4d698371ff30062
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ooMs.ico
                      • Path C:\Windows\ooMs.ico
                      • Size 4KB
                      • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      osgc.exe
                      • Path C:\Windows\osgc.exe
                      • Size 1.9MB
                      • SHA256 a14850fb768cc27a29cb7d225d019f321b971324c8755875fb2488f16aee4596
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qIoq.exe
                      • Path C:\Windows\qIoq.exe
                      • Size 1.9MB
                      • SHA256 4878e8341150cf338f5a3539c4c6669fe7c431d8bec1bd5984fe2d698c057b57
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qMgo.exe
                      • Path C:\Windows\qMgo.exe
                      • Size 1.6MB
                      • SHA256 5cc1d0b1ec4eb53b1f0e4b41e1e69e563dacbae6508613707bf3a63ecd509f68
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qgAe.exe
                      • Path C:\Windows\qgAe.exe
                      • Size 1.8MB
                      • SHA256 4c454c29ec3fa0570915ef9c658716e6ddbd384662b37b1bd06889946cbb592a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qgsE.exe
                      • Path C:\Windows\qgsE.exe
                      • Size 1.9MB
                      • SHA256 660a7b525eecb84c32c9591286b590ea3e26c9485c2b5c1c1faa0af5e43a92a7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qkUW.exe
                      • Path C:\Windows\qkUW.exe
                      • Size 1.6MB
                      • SHA256 7f0b568090fc476c88615e57621dd7263c7407bd8f599a3684d7c9acf4e00b63
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qksU.exe
                      • Path C:\Windows\qksU.exe
                      • Size 2.4MB
                      • SHA256 255867f59952e838a507642f16fce1a5f86211ad0f73d405107a127de21955db
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qsIg.exe
                      • Path C:\Windows\qsIg.exe
                      • Size 1.6MB
                      • SHA256 4af668263d7accd1a5418537a6d03681288123dc29820f207db56cf9125ac980
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      sYca.exe
                      • Path C:\Windows\sYca.exe
                      • Size 1.7MB
                      • SHA256 546c9136857e0a2182c8f0b5d6b4b605e43e6069a6ea0fadc9c51316987c2688
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      sccw.exe
                      • Path C:\Windows\sccw.exe
                      • Size 2.0MB
                      • SHA256 c28943573e486feddf41564ba7f87313bbcdc630fc7e43182feab3fe4829a7ce
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      sgMY.exe
                      • Path C:\Windows\sgMY.exe
                      • Size 1.6MB
                      • SHA256 832969ecc1bbeb96d9c778db93faf5cac928ecceab8e3af9fcc4054c21fa3c12
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      smwo.ico
                      • Path C:\Windows\smwo.ico
                      • Size 4KB
                      • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ssoi.exe
                      • Path C:\Windows\ssoi.exe
                      • Size 1.6MB
                      • SHA256 2ad3699580de83e7d90d78aa5cb688ca2cda748ab1c56753936d5395b0dd4d4c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      uAMS.exe
                      • Path C:\Windows\uAMS.exe
                      • Size 1.8MB
                      • SHA256 e364a196f91b28440ced8bb8e90045cab299a118132c892141790629ff480a59
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      uEUA.exe
                      • Path C:\Windows\uEUA.exe
                      • Size 1.8MB
                      • SHA256 a3afd2b313a61a0ccba8daaf69cd1f5e960dce62d8512627c3ccdbaea5c5ee6e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      uQMg.exe
                      • Path C:\Windows\uQMg.exe
                      • Size 1.6MB
                      • SHA256 b1fea401903ae923196d0269ceb177f238f5d2b4bec0b25155fa060f656ef94f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      uUcM.exe
                      • Path C:\Windows\uUcM.exe
                      • Size 1.6MB
                      • SHA256 005d2de327977d53fbcbf6c94a6cb3c3fbeb0ec8d03e6f914a20f3168a388ad2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ucAW.exe
                      • Path C:\Windows\ucAW.exe
                      • Size 2.0MB
                      • SHA256 26d95d5e900142ee7570cab1a4077bb6242faacc45d0effad4613e1c8ac93f22
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ucUi.exe
                      • Path C:\Windows\ucUi.exe
                      • Size 2.2MB
                      • SHA256 5f3f8d65cc4da833c4a2b4b67b4dd3c124552a06fdd25627d350b6ec34471f94
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      usQe.exe
                      • Path C:\Windows\usQe.exe
                      • Size 1.8MB
                      • SHA256 5d374d6648417b77c229ec3dd5630f5fd597e1ab65f64f70f20cd166bec9d44d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wEAO.exe
                      • Path C:\Windows\wEAO.exe
                      • Size 1.7MB
                      • SHA256 0826f83bf8bb6a6871877b15c8b146ebaeed1d2fc7f087670cf464efff8711db
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wIQa.exe
                      • Path C:\Windows\wIQa.exe
                      • Size 1.6MB
                      • SHA256 a6a7abe4b0d7fb72efb2ab4ef852d6df8f272c6ddb7961b7b01aecd8e03fda2a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wMAo.exe
                      • Path C:\Windows\wMAo.exe
                      • Size 2.5MB
                      • SHA256 13c639d6e0107b653b1a05532118dd49d6d246814f9a6dbd589a357a28248879
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wMAu.exe
                      • Path C:\Windows\wMAu.exe
                      • Size 2.1MB
                      • SHA256 3acb223aafa513141259203968acf246d45dae0eb6f8a55bc2c4c2513491b39a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      waUA.ico
                      • Path C:\Windows\waUA.ico
                      • Size 4KB
                      • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wgQC.exe
                      • Path C:\Windows\wgQC.exe
                      • Size 2.2MB
                      • SHA256 a67447244886c1a97bcb70ba5e2285776136939d6d429d2c27bca1c691a33023
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wgku.exe
                      • Path C:\Windows\wgku.exe
                      • Size 1.9MB
                      • SHA256 3c3dca3cbe2d2065df154c7cf2c2098a289970934a21a74895da0402f06670d9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wogA.exe
                      • Path C:\Windows\wogA.exe
                      • Size 1.6MB
                      • SHA256 3540c4c2da9ba62b97c28d888580f8067513a9ba9a8c09d45c95bf6af2cdee4c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wwMA.exe
                      • Path C:\Windows\wwMA.exe
                      • Size 1.8MB
                      • SHA256 c66139aa7c3eb91243cb900d6760f5db98db502b96aa31ad151d87989f37c2fd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wwsU.exe
                      • Path C:\Windows\wwsU.exe
                      • Size 1.7MB
                      • SHA256 e0962873e3a45ff826bead50386ff16c9977e67f479a4948d4825aa0e648ec8a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      yAMm.exe
                      • Path C:\Windows\yAMm.exe
                      • Size 1.7MB
                      • SHA256 8da76a24e08198f9fd18cc685caf391731e666c5edee039e02686b0a58a46139
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      yIIk.exe
                      • Path C:\Windows\yIIk.exe
                      • Size 1.8MB
                      • SHA256 ebbbe1ed90dbe43c54ee35136bf8e9638c33ceb06f004642af71bf0b570c5dcb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      yIcE.exe
                      • Path C:\Windows\yIcE.exe
                      • Size 1.9MB
                      • SHA256 54fddcd4be4d77c58a22ebc1d55e7b1e1e6416857c945af7eec6e8c1707de283
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      yUcS.exe
                      • Path C:\Windows\yUcS.exe
                      • Size 1.6MB
                      • SHA256 c0e4aff8bb483f61e405b3b827e71ca8e94f8de3b7510a40d6fafd8687b18615
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ykAg.exe
                      • Path C:\Windows\ykAg.exe
                      • Size 2.0MB
                      • SHA256 a67d07b2aaa5736e5fa30e44104412c10741c859f9a9c209813a9c3a5d88340f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ysQu.exe
                      • Path C:\Windows\ysQu.exe
                      • Size 1.9MB
                      • SHA256 029a0b4565460649d3aca070a83236b795e1b0837b4045677305deaa988ad763
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/940-2163-0x0000000000400000-0x0000000000590000-memory.dmp
                      Download

                      memory/1116-140-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/1212-66-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/1308-226-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/1924-19-0x0000000000400000-0x0000000000590000-memory.dmp
                      Download

                      memory/1924-2153-0x0000000000400000-0x0000000000590000-memory.dmp
                      Download

                      memory/1936-185-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/2060-380-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/2160-2158-0x0000000000400000-0x000000000058F000-memory.dmp
                      Download

                      memory/2296-2148-0x0000000000400000-0x000000000058F000-memory.dmp
                      Download

                      memory/2296-16-0x0000000000400000-0x000000000058F000-memory.dmp
                      Download

                      memory/2476-2143-0x0000000000400000-0x0000000000590000-memory.dmp
                      Download

                      memory/2476-7-0x0000000000400000-0x0000000000590000-memory.dmp
                      Download

                      memory/2516-98-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/2672-247-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/2924-236-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/3440-258-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/3464-0-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/3464-32-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/3464-33-0x00000000021F0000-0x0000000002210000-memory.dmp
                      Download

                      memory/3464-1-0x00000000021F0000-0x0000000002210000-memory.dmp
                      Download

                      memory/3536-171-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/3568-154-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/4140-199-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/4376-127-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/4516-446-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/5000-83-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/5248-51-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/5412-216-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/5872-292-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download

                      memory/5936-109-0x0000000000400000-0x0000000000598000-memory.dmp
                      Download