Overview

overview

10

Static

static

3

2026-10-08...ck.exe

windows10-2004-x64

10

2026-10-08...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/10/2026, 18:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
  • Size 1.6MB
  • Sample261009-xcv14ac16w
  • SHA256 7a499ef19ffb224dd10444c643c35b3ee9510f405149f6920ea7716846cc2248
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 64 IoCs
    defense_evasiontrojan
  • Renames multiple (102) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs
    execution
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4584
    • C:\Users\Admin\KqwwYoYc\fUYYMUMo.exe
      "C:\Users\Admin\KqwwYoYc\fUYYMUMo.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      PID:3388
    • C:\ProgramData\UKUUUwow\kEkgcIUY.exe
      "C:\ProgramData\UKUUUwow\kEkgcIUY.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      PID:3204
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2460
      • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:6056
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3008
          • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5924
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5652
              • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3820
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5320
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:5916
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2468
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:5000
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5308
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:1776
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4164
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4560
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4112
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4928
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4336
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4868
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          PID:5484
                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1152
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                              22⤵
                                                PID:1820
                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                  23⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3920
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                    24⤵
                                                    • Executes a command shell one-liner
                                                    PID:264
                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                      25⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:2996
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                        26⤵
                                                        • Executes a command shell one-liner
                                                        PID:2264
                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                          27⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:2520
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                            28⤵
                                                            • Executes a command shell one-liner
                                                            PID:4236
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                              29⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:624
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                30⤵
                                                                • Executes a command shell one-liner
                                                                PID:3284
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                  31⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:2296
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                    32⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4720
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                      33⤵
                                                                        PID:1040
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                          34⤵
                                                                          • Executes a command shell one-liner
                                                                          PID:6104
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                            35⤵
                                                                              PID:2632
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                36⤵
                                                                                • Executes a command shell one-liner
                                                                                PID:3208
                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                  37⤵
                                                                                    PID:5544
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                      38⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:1544
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                        39⤵
                                                                                          PID:5704
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                            40⤵
                                                                                              PID:1964
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                41⤵
                                                                                                  PID:5384
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                    42⤵
                                                                                                      PID:3772
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                        43⤵
                                                                                                          PID:5540
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                            44⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:2336
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                              45⤵
                                                                                                                PID:2236
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                  46⤵
                                                                                                                    PID:5076
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                      47⤵
                                                                                                                        PID:4888
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                          48⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:4776
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                            49⤵
                                                                                                                              PID:4156
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                50⤵
                                                                                                                                  PID:4272
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                    51⤵
                                                                                                                                      PID:5100
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                        52⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2832
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                          53⤵
                                                                                                                                            PID:6000
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                              54⤵
                                                                                                                                                PID:4144
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                  55⤵
                                                                                                                                                    PID:3936
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                      56⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:5992
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                        57⤵
                                                                                                                                                          PID:5864
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                            58⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:5768
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                              59⤵
                                                                                                                                                                PID:5808
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                  60⤵
                                                                                                                                                                    PID:1036
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                      61⤵
                                                                                                                                                                        PID:3028
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                          62⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:3768
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                            63⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:5404
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                              64⤵
                                                                                                                                                                                PID:4196
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                  65⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:3308
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                    66⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:5044
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                      67⤵
                                                                                                                                                                                        PID:2720
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                          68⤵
                                                                                                                                                                                            PID:4804
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                              69⤵
                                                                                                                                                                                                PID:3384
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                    PID:3380
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                        PID:3100
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                            PID:2640
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                              73⤵
                                                                                                                                                                                                                PID:5380
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:5656
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                                      PID:5584
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                          PID:3476
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                            77⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:4728
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:3440
                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                79⤵
                                                                                                                                                                                                                                  PID:4796
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:1400
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:3684
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                      81⤵
                                                                                                                                                                                                                                        PID:5740
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                            PID:2324
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                              83⤵
                                                                                                                                                                                                                                                PID:3484
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:5560
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                      PID:968
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                          PID:3420
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                              PID:796
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                                                                  PID:1228
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:3776
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                        PID:5844
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                                                                                            PID:3692
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:5412
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                                                                  PID:4424
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:2904
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                                                                                        PID:2900
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:3784
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                                                                                              PID:2848
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:5784
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                                                                                    PID:3212
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                                                                        PID:4180
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:3012
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                                                                                                              PID:1660
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                                                                                                  PID:1060
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:5408
                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                                                                                                        PID:1256
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                                                                                                          PID:4956
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:3296
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                                                                                                                PID:3344
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  PID:2572
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                                                                                                      PID:2512
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:2440
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                                                                                                            PID:1956
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:4592
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4796
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4836
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:3728
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                                                                                                                          PID:580
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:1920
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2428
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5288
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5868
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:2124
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:5532
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:4316
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:5592
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:5932
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                    125⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2560
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:4416
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:4464
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:3272
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3732
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3216
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1280
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:960
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2964
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2104
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1360
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3104
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2724
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZKMcAUow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2672
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3560
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dksocgcU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3824
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sikUAIUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UGkgAUIU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3464
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ciIoYoYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:204
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NqAsssso.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1496
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3716
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pwYQwsIs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1436
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3908
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rcoQoMUo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3732
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1652
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZQIUQkYA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:712
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3216
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QMoYIQoQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ESIEAEcA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2560
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SsUIksEw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2376
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1636
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BcgMYQcU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:960
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:900
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RcssQgEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3908
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:248
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3792
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HQAUQwow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2724
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\acoAEgoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:848
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:580
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2560
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MckoEkck.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1240
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OGkQcMoA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5480
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2104
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WekwAkAc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3864
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JKgoUQsU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rKcsswkI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2232
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fAQkMUgA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5780
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:204
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\goososkU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:580
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3560
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AYAUEowY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5472
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eWcQsgYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2900
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HqwAoUsQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                      87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tGUMQksU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1636
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hEcoUokQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VIYwQQUU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2964
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mmkcckAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:248
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UYscIAAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sWkcgYEY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3792
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\osMkwwkQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1556
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lacckokc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3156
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                  71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3732
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nQUMcAgo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2900
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3864
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xkUkoQcU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:968
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EEsYUUcs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                              65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:712
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eusQMAQY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2248
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3560
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GKwEMkEE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VqEowcAw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FYcAsQMA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3064
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            57⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2964
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YKwUIYQw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1056
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        55⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EsMssQsc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      53⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1324
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DWwAYEcY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    51⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wacoAcUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                49⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          46⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3824
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          46⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1956
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            46⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vAwIYAUc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            46⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3112
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                47⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GqUMgYkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            45⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3628
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3936
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JskMcgwM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3996
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        43⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2280
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QaYsIYUE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                        41⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3104
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          41⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                      39⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tGQggQsg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          39⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    36⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    36⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      36⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jyokEgok.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      36⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1988
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        37⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2376
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      34⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XmccYYEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      34⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        35⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3792
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yYAMIMsA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        33⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1324
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ogEAIIEE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    31⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6024
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              28⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              PID:3140
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              28⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5636
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                PID:1956
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WkUookoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  29⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1408
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            PID:5472
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:1980
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:3628
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DggIocMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4844
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                27⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:4836
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          PID:2044
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5524
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            24⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:4704
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hqUYwIEc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            24⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5272
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                25⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:1280
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          22⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                          PID:4504
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          22⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5884
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:916
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\roQQosUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:3124
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                              23⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                              PID:3772
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4196
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5896
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2924
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rQYwgwQg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2892
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  21⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5304
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:1284
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2752
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              PID:3980
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UAskskQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:944
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                19⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:2124
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          PID:4808
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5584
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:5704
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YOcUgwgE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                            PID:2944
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                              17⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                              PID:1104
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        PID:3440
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5044
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:4996
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HYwMcogc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                          PID:4632
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                            PID:2672
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                      PID:4116
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5788
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:3208
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VQAYEkUw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                        PID:5252
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:4704
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:4464
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:5100
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:4796
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VOYoAYwI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                    PID:1596
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:4156
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                PID:3644
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:2392
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:3104
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MSwQMUcg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                PID:2268
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4428
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              PID:5844
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:624
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:5316
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yIkMIoMk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                PID:1520
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                  PID:2220
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:1388
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:4112
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            PID:4400
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\soMMQUUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                            PID:4716
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:4236
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        PID:5128
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4548
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                          PID:3372
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZGQUkIcY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                          PID:124
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:620
                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\QCcUkYUA\BaUoIkAk.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\ProgramData\QCcUkYUA\BaUoIkAk.exe
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                        PID:4364
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\KqwwYoYc\fUYYMUMo.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\KqwwYoYc\fUYYMUMo.exe
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                        PID:5084
                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\UKUUUwow\kEkgcIUY.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\ProgramData\UKUUUwow\kEkgcIUY.exe
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                        PID:400

                                                                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                            Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                            Resource Development

                                                                                                                                                                                                                                                                                                                                                                            Initial Access

                                                                                                                                                                                                                                                                                                                                                                            Execution

                                                                                                                                                                                                                                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                                                                                            T1059

                                                                                                                                                                                                                                                                                                                                                                            Visual Basic

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1059.005

                                                                                                                                                                                                                                                                                                                                                                            Windows Command Shell

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1059.003

                                                                                                                                                                                                                                                                                                                                                                            Persistence

                                                                                                                                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1548

                                                                                                                                                                                                                                                                                                                                                                            Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1548.002

                                                                                                                                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1548

                                                                                                                                                                                                                                                                                                                                                                            Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1548.002

                                                                                                                                                                                                                                                                                                                                                                            Hide Artifacts

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1564

                                                                                                                                                                                                                                                                                                                                                                            Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1564.001

                                                                                                                                                                                                                                                                                                                                                                            Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1562

                                                                                                                                                                                                                                                                                                                                                                            Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1562.001

                                                                                                                                                                                                                                                                                                                                                                            Modify Registry

                                                                                                                                                                                                                                                                                                                                                                            4
                                                                                                                                                                                                                                                                                                                                                                            T1112

                                                                                                                                                                                                                                                                                                                                                                            Credential Access

                                                                                                                                                                                                                                                                                                                                                                            Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1555

                                                                                                                                                                                                                                                                                                                                                                            Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1555.003

                                                                                                                                                                                                                                                                                                                                                                            Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1552

                                                                                                                                                                                                                                                                                                                                                                            Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1552.001

                                                                                                                                                                                                                                                                                                                                                                            Discovery

                                                                                                                                                                                                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1082

                                                                                                                                                                                                                                                                                                                                                                            System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1614

                                                                                                                                                                                                                                                                                                                                                                            System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1614.001

                                                                                                                                                                                                                                                                                                                                                                            System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1016

                                                                                                                                                                                                                                                                                                                                                                            Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                            Collection

                                                                                                                                                                                                                                                                                                                                                                            Data from Local System

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1005

                                                                                                                                                                                                                                                                                                                                                                            Command and Control

                                                                                                                                                                                                                                                                                                                                                                            Exfiltration

                                                                                                                                                                                                                                                                                                                                                                            Impact

                                                                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                                                                            DwMA.txt
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\DwMA.txt
                                                                                                                                                                                                                                                                                                                                                                            • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 6b6a8091e65f0dbbdbed5610f405fdf074270b0c9290cf8f1994b73768780779
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            BaUoIkAk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\QCcUkYUA\BaUoIkAk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b01b665588468979a06cce873eee77dde40c362cc1ee3bfb0ddd5026f998736c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3d47297c47386702e67091fbdec324018fdbd0513c07ac5a41dc8f7a47b11512
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 69a8cbe9d3760015a0f63e74bc700ef8be3bed605cdd7b67678ee25d98ee5a64
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ffe7dc2bd7aec5a3fc11269b113ccbd6ec721bb68466436694ddfb04ee0313de
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c4dc26d165bc8672d014389d5620617bd70d5218afe344d322f38ae9e5d5f2fd
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 84007e1b24dbba1aecaf35acdd8872a0c4cd25b5d6224bcb53c6e376586b56e5
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b08c344fc824c6d5158318cde6156b1bd072a13a07c744ecc71d91e62ade0a1e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 58c765bf904d661ccd16ecd0795e75db95c0d23868c7e2e6ac885d09141c832e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0107a1306a4f53e5caf14393c798ee1f137a2126b7c6904f84da363ddbd6fe97
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4a3c085c591f9c6154f6edf8d35f74a1f4ae91c74df36e6443ec6ab8f3c7d669
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 1244085ac8a91e2c5e1d7cb7153f1429f56bcdc9d91e45618dddbab7da51184e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 139ce057d8c6e4d91b70ec81bd27d14c20c4b79aa9564548dc4ec69f133cb369
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 360fc3bb4e60c61a4a5aac90ef77ac13c561fa66036bc497fa30f275774d22ce
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f23513c1dd5cd53ca295a43424c2fe21733c60141c65a7320e1bcf71d1cd69a2
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 005d70cf4c98757f4245e9513e30d656711f7ae3b785c274624cb522fed1495b
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 14cadcdc0c1a4bc3959f9fe27446c10831eeb0e8e875599e53ac911ef266d396
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 bda4e97583bcc9f314b15a75a216235c2208ac732b16eeb5b3b57e33fb41f336
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 233d99cf2db302ccafafefcd551983bfb09326a272fe1864faf34330b5795f21
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 29b35a805acfd849f497604d753e84da8b127bb0c88721bd3038ae817b689337
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7e05e7ff096a9ec5de70377f3a726df2da713e44f87661e74892fae65a75b55b
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\UKUUUwow\kEkgcIUY.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 1894f4247933ea1de03b1d995bae1901087674d717436c881ea35c272c6c3967
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-08_2885814d5e00419532718700633c284d_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                            • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 63f95aa316029c24bde96eb7d8fb531729c6cd2bcbed1a0497d31faa5a42d6ac
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            ZGQUkIcY.bat
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ZGQUkIcY.bat
                                                                                                                                                                                                                                                                                                                                                                            • Size 112B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            file.vbs
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                                                                            • Size 19B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e307e75484b983219c44b42f48641173b45ef2da52a39adafe37cea6bf283183
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3e6d7a5ff4ef986476e46f4ff26e0f3fe255315d7d829024cef5fb368cfe154d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e86ae8228f53c06afb7edc5712a6e05a1aed3b5bb276f18b4d2ff8065b835d51
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d39b73aebdc080231415a85886cc897e7eab7900def0b11f0951ffbbfce27698
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 fd2a5e24da03388d734be4f163ea26cebf14285d93df6018f6a00ef8ef7d09b0
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4f81245829272c17dd650bcb33fd9bc665ca56176a796f1a82c091cf19ae13e5
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 dda30e1dcc1f14363aca06fd59a501d52b6c890fe0c23fae1ac212f957efa3d4
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5bb355fffd41532c4ad23e379b8b7cdec5cd872b1854e4633c42f26c5062c006
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4d643b0db8e192cb7b50c1f2abee84ef679249cad53346ee27b62cbc292fca8e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4d86ce5c293ecf521d742fa879736c5b830b51ffc405af5989edd1027d40e5f9
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 395b63cb8b3fd1003337eb74b158db6d19ff5ea708f364e7c2b8eaf109642f66
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e0a1d1bebdcb77902316d3b8f4cca92e825fa771e5706afa798b6175a987eaf4
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 78223f701f5e9c34c2046e4e0aa41eb21241c5c0f4fa452365ab51904efd2c83
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 72cc779aae0a0b7900152d8b74372ba93fb1d5f9a83333587fd7807d7441d169
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 767de285ceeb3dba23e64f7fdf4ee80a8ef694dec496844c1e5b00c3692210fe
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c2f369388b8f7fe7fa29b790fadfcde5169707e3813124d52b2fee9a37cf20c2
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 65d523c0558c6274e52a4e1b964f098c0b686e1ff17210d3f148473be83e02da
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4fd65939f320a85b6f6fa821de50e79252370f16c0753065f3ef61028fc2c666
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 37e8d23470a7b5f274690f94aa17466a3211f22720742fd1949441ea194db0a6
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b86585457ec0ffeab6498e0d11db133fa4c6787e9a72c002b903735627f9168f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 95242906e13faa180d3def662cf6c0d0be2530b6907471505540471f593ef450
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e27ec683fc69e6b28408af25e805424bc326f138eaa341c54980ceed7b91b421
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c3b2408206882ff94d7995339017d5973ea7199da6253f4474f0d6d26164b931
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 faf89eb6d837684823711e4761e8390937869b296d9a16218e9db919256d4d58
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 bbdf6070ba66b736d6dbf1f524afa8dc0f8528e0744753d31aa3cfdfc578a1fc
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ea3aafbfead7ae2fa5496eb9612335c54f3c3a6e4d735b20c989732e41523028
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 13a452a5d1a877d78f5e8406784be22fc14ca5833d13a916907e82135b814ac3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 aaa1f823a89a4af4decb3c353b15e2d391ef2b7a8a37cc9b06cf925bc8f2b61c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 26e45a73a728bb3c05c689974d747a7a670e8833dff862510057336e5a553a84
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 6fcd22aec412b92cf3b6cfa42c9520bc01a22193116bfcd673eb031ae2b46f3e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 af7e7081c01c4382041eb88ce48d955a06c34388a9fcfd5684d3584a1099fe41
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3dc358c5302e5298f2a6520d26bf12341930cd723c093d05860c70297eb0a528
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 582cd91514ba1ea483cf0e8b164052fa2813796b673cce423f3c4b5bf534ee8f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e1e53ff7e5a0ff674cd2d14bb0555d966cb3c835878b1d8583f8470e1bfe345a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d63834063c631bed090588296cf59d76e174f097acd95e131d75046a8366b3d9
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 9b53a29aaa8565f8497f2f57070fc672dc2b68c482b917fcaff5b3ba5db32835
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 710f1881d651835ac197eaf0f0908d8d53b9a456ceaf3f2e2cb846232ed654b9
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 fc5e821c4c4c6822a116c609b083f0feff8adb9d6eb7e7e612d4fe7cc17b788a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 17f93a7623d9a45234947e5a9ddc03fba5805ddc72a3f1759e40342ca828eb37
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 6d3ab66484ff1eabdb125f303c9890fb676aeb4743cadf5f975b1a6e7dfeb7c5
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ba6281492bce65bc3f671d4d7aba3a87e9edc7a1f56806ebeeeb63a01ea581fc
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 10e1dc4676d5fa90297d3859f6520217fcdfcbd2fca5fdcb5ac5720fdb55335c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d4e4243ef891f5281cd91dcc5eee61cb7fa6629b4302529c5d214140051c36fc
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 2e06b472c717df66f8caaf0b881b19fc3de974e763e5705587e7ee38c9bfa68e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d09b2f322fe9f90fd8e71cd4ca4e0dbf085b39b8773ca687e716168928bf179b
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 099c3416a6054213e0dc8981c46098e5900a22dd94bff52e3efa5421b3901bb0
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f3ea8e8477bd11baf89ad7782aca08902e9f7eb5f76d437d53c94cb928795ba4
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8d7a03a94cc5b8b3c2569b098c44c034d8d7f5cd3c0a11b6cfa7fa38ce727253
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8af54eab33fb88ffaf59e385b231fa004e1158309135556faa2aa835b5fd46a1
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c3949387a9b93ddd3933bc02d8a5fbb0e32cd6dc53bb148df2a59640d409ce5a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c7e0e8c092310c8912e7cbd85bdd33b120a066745fac1f4b616d8379d57ed1db
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d502e341ded9a4ae8c528db221f00c3561b9dfe372d73320a949a78610c69e2f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 bf8ae11b4729fc07aa68d3608b5daeaf1c390967e7060225d918e04f209e2a1f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a1532f2ad62a9ec93d92184949167cdcbf25a8ed73cf8c130ba1d62a1c74988b
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a1b9bdb6191548ab01e199a11980c8df2c234786ab5a4d860c71b12bfb6c2a07
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4cf6f5c8513b56250296fd9fd02bd55bab24607fa75a407943cedadd4a3b9afc
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8188b0c6cfc6349fcb53add59d74e14ec1af51cc454f2022e17ef2bc0558fbca
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4376857e87aaffaee88611a4f3b7bab7f5b03c499f3c3515c1332cd9e3a5b9bb
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 1dd1718f9e6433d6006d40c7685cfa51ddc5130b0acaa0d482cd371cdcad8bb0
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 9c6894dff7386388c8e353a8709100f877ee1b43d07b636ef4604ddccf80e3ec
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f7550d8c11b00f3ab8dad154d251bf92d21299d1d8a73293048a8a316d42e735
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7682e5752410a668126d4eee2b1909f5674f1dc6acbd74698cbb4f0e7f75e57f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 cfe38434de20be282386cba23fba982d04409c6b0b33bd7a8b09f735f76743eb
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c5b87a059f9808d5d0315ce11ddb28df3bbf944efae396806d95814c49bc1591
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 aefc22def3c27b311eb0c52856732d13c126f13293bd815761c83d8c8590fc23
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 59367661967db6076e9bed56edc48af0ed96b74661aefcefb035117f0aa35ef3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f6e37e4d17301fb44170a838ec257f1e7dfcba95b0d0ca6b8ea8a8460cab94c7
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8478563d881ad21dc931cba96f65cd2a546c7d7c31a821d91392d606e926d1b3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 2817006abd6224922abb7a5baec7b7d2dc345e659d8b95ee25871d81a399171a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 cf2bc315f71e2e6db50e7e606d2d181579292937d279466197103f8be18fd0e8
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 92a20209cf01b8e57bac08e719740710f7d8600721bb243a95a9e5d4e6bdb476
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 2b60afcb08707a3bda09cdff30b206023395de38ab83ab9043b1d0a88fbfeaa0
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7ef708cc58459516e355e61a60ca9bb4236fe5a1ee65bfc3fde46038f82aa6cb
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 684991aa51d9ac362a7cd72840bf1b61c69f0d89833402d4c81165971a5fbf17
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 237999408178c77fdb36532c674d241979bd51a4e49033749dccd55eecd7feff
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 cc09ddb0eb7563ee85f2b6ab2aa984ffd552659ae16eb5e3f047ed9c5e7896d2
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 cd7b731f9507efd70abd508e452c239ee62e8965fa4843732933e84990141d03
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 57daa9dee755fb8da7f339f9571fb17882a3a4f8830f8c13f5e2e115068cd824
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c9f7f8635f30f0aebceb51bcf01292d29d3f020e486eb6f4cf164b6c812cec71
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d6a5ae5c687bd3d922b29a2bdf5eddb85b2e2aa72f45ad5d91f2365bf320bce2
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 cc8a31e828e9d351eee1c41edebcfa138fc1a25f05f49796c7d9e2fb33acf5ab
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0d94a7237fe553101ae005ddffd30925ba692af125f9bd1f4428cc00f80fb946
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 eb17f58295b9f56f94b4948fc472dc3180bbd8371677484cde0fe22592cac43d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e366a415db34aca344e9368084db8aa7aee15745bf2e711d7b027a8827a130db
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 bfc7627b47d4c241bd10e28a4bdd44354f8bc97ffc18d668a79392a15d905eac
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4705280c83d28ed3eb5a8e0b0ef322ab99195e33ab644d26b28345deee4009c9
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 653a88a15e5f0d79ed3da1f44ea30a86b2c743e8a5da5485264211f3462a0382
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0c2f2e58b9ddca865e7372b212204486ea2ddc533db48633766a2901af3a39f8
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a86b70a33a15d31acbac66b111a421e5cedc476f818c024fb45bc3835729f428
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8891126e7455f28515b4a4f2b33bad192047e23c647ecb94265921c841075706
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 480f872282ec318bd11ca7dc82ce3b205348540c30d38a5f2fbd3472c1eb2ddd
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7e40212a64e0922cee562046a7625c8a39bdad7cf5511ca0d86c34fbdb0d92a7
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 81b261fef69ed5ee64294406467f3edb404a0e3752f073fdff01343b484a4205
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0df8a99e577fca362e8d88fb455f1af1b3e91435f6a380bf2a56bc41a3011452
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7f5434a5eacdbc1e0f8fd7fbbc72b8e57bb690089355cf587c844d14f61f48ce
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8d420cf145126a0fc9944feb73efb97e068d95bfc2eac574378a9820a9066ff0
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5a905af3fcb40688b71b8412d3aaa2e80a370d19a771755b07cc96bf398dabb5
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 fc1e72d483bda998a9793c707f88fa5d1c76c7a60fca0cbbd7794b57c1e0669a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5bb7133e46e49670a512efad9be74a69551b4a7ee1cd27e26b621e1be390b013
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a9e2fc5eaa9ad087991a49e0f383ad1c7e05577c9d6e0e7f049d48aee1b9ede6
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8a8dc5db10e66ca73f11ce33bbd7b5fe6dbc2646db7294c2e2aecd75acd7a246
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3bcc423ba6038e153c31ec11b6af58fa192cc0f3549feae06a52987fb93f8f22
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b7f5d7b9caf0dadb6f40cd80fd2dab0ea5558d78aac7efc170081c14a64eada9
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 72cb978d0a1916c3e6f2b7b470f62cf24eaf37cf852f3b997900e7683488654e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 77bd0d5826332438d0cda519b99add7c369d63af91a3f09799a7b5391ca71973
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8e86aa3443275e7733cc2d84a344d95b5a1c5483fa030272be4f5bd5ed6a6b91
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7cc1115854031003f47e4ad3e8c85be107351b726806cba6597f0fc0cc144c34
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8a83913427969a8079d58b33cbf9b198822edbbf9b4cc241fa19ed21d29e8841
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\KqwwYoYc\fUYYMUMo.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 516936a2d046f94ffa3e17c1628aec33f6940b2a3cf85e156af90ea527ccc94b
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEEq.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\AEEq.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c996d8d69a597ef311e9fe499c7402353aa000cbaa65949a8102d4b20fbe0f5d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEIk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\AEIk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a1d116e410df222c1fbc3b92a36b3cbc86a292134c6d37b09f34c4a4b13f7e5a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AMwM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\AMwM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3ba2805d7051f2972772d36d0644de2fb8697492b8d2e993d7deb23aca6cff63
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AcIU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\AcIU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a5e2c8e47ce7c959b7bfddb8d1faa65a2170547484ee1ea419a62bec6cb8c964
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AkYa.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\AkYa.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f99d1a567304b2fd13a3d148d821c842ae0da78cc701cc15bdf6e256f38de7cc
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AwMg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\AwMg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 32f049b63326b1b88ea0413bd0e291c92d75633fd5fef392e29d1137feb9a9c7
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AwkW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\AwkW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e3771cb4c2d0770d7be9f19d02e41346af201a89d830ff57ef6447163f7d84a9
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            CEIM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\CEIM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ca6eaebd837848cc22d07618f18d2fedf89da50fa39655513fea25ec22d1f872
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            CEgI.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\CEgI.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 1e9174401a20f48ee55830b06468a6b645c819e719174641b8ed8f4527a3efeb
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            CIgI.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\CIgI.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 3.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 608491953ead6ea4a361fd594a77f60e7ca5d828536172621e1e50762f8e5754
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            CQAm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\CQAm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 81c3ea7dc36c715871b19111b1f58c3426d54f08a2ae144dd38f016929c0452f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            CQss.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\CQss.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            Ccsc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Ccsc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d3a2c71e8f005de6b8d4add32ba300b6c6232ce18a0a04c88683114a2ec29779
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            CsAU.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\CsAU.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            EEIg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\EEIg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b8d5a7594b42af4d3d47ff4e3a146dcccb8bd17e43141f6932288a00daa98ab4
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            EMsq.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\EMsq.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d6b4d0a35c271549974b292c87f5b1f3ef5e59a59d4dedfdd90a7828c86cd116
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            EQAE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\EQAE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7c3e5f14f489d613e897a90e04973b25ae0f87bd1de749307a3fa5dc39856829
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            EQMw.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\EQMw.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            EQYg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\EQYg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 2e6b69cf8d7a17a9a8d6cdac6d135d8eed3ce814b48eb8d34b221981f65230b9
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            Ecgu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Ecgu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 112ae1f5fc63e3a1ac06f66250e7857f2df6f1b61d312a765e6d00c7259b3614
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            EgMw.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\EgMw.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c72001c15381c2b606e9e18e3b4444ce286ceafa691764784017842783c2a4a6
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            GAEy.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\GAEy.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ba3780d27030467f1db750df5a4509732835cc4f494f39d05396dc633710e8c2
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            GEUo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\GEUo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8998b4aa983bbaddaedd02bf1e987f7d56c99272afca143a1b4caf51a6e38ea3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            GMoK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\GMoK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ee869dd76b808903f1bdf009cfb44875709c64a1394f1732c74be3e07ff3716c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            GMoM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\GMoM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c1af98e5f1c3af3b69ffe3ac98a2031473bef5b0beb5aab48bfc0c82def659db
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            GUAK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\GUAK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d8175a693588eecc80657f9886c3e77e701afcaa3f142a9ebeef195df3672fc5
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            GcMM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\GcMM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4209b364d9c4f71e53f0a9220605f2d181335a7af86a54cdc734710b57a063cd
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            GsAI.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\GsAI.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 013f73829a3f4b5e09ac1ea126e078e2274815ebe6a88d45d6c2110844c28819
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            GwEM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\GwEM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 07ec206c7094a15415fe28c32525f9f57190b9903b6e4bb3806409f795d7ecce
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            IEIM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\IEIM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ffe1c89eda8b153559a4807e4c70acb0b0d10a1560f069f72aaffbf1158328f0
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            IGkM.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\IGkM.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            IIQi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\IIQi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f1ccbf93611015a4756fc0d4c779e235eb8fbf5baf1bbcd979be4bf027fb04d8
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            Iskc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Iskc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d3c6526850cbab2819b83cf35349763efcaeba27c3a0b334f17dbcdf0242d2d0
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            KEMU.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\KEMU.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            KEwm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\KEwm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7755120d9f33e11852862e736ba55fc83175024a510b74b6095e3cc45368b216
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            KEwy.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\KEwy.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ea6febd635ef8225d16e72b53f873333bddc4a2a7420539124ef3bac2b670ae8
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            KIMG.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\KIMG.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0e74f4b350b7d95e1bede5fdad233bbc1250a954b6b2a701d5a96799d91c35fd
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            KIka.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\KIka.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d3f503538b03947afd4e71980f16fbfc561f820b6247c2f699ecaad42ed4fe98
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            KgMg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\KgMg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d52fba9beba48f154c7fa41af93a3400c134f10481a8a0a31945a700bde30ad5
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            KoIk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\KoIk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 1dda366671b9256bb63c07fb0e98db801d114300f814a8b0762d231a13a060ed
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            Kosk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Kosk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 3.3MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0459d3bc07aecc94f4cac0531e3d48ebff411fb81ffc9de59f28ffa626113dc7
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            KwYe.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\KwYe.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f862ff5ffbc2229d0e65c6e92fd1f4e9640923f5b8b3293643ef1c23aa4280d1
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            MYgo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\MYgo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3188834302cb6a0e4ca78e4e94c28d33ee21b49a89e156124eba28d6b43b8211
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            McEQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\McEQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 645e1261392fda3e5e90e0227ce5b725ae2e568deb14c396e1934191b7e3606d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            MgUU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\MgUU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 28928bc8ce5ab1e4cc72ebfee4cf0f958658007471594c4f035a1cefb9b54cff
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            MsAs.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\MsAs.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            Msog.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Msog.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a52428e209f78fb6e6901d2c98de92c94b1f019202e18e4a870cd89ec0d05cda
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            OAIQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\OAIQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d86cec7d3ff3537cb3d13a4808db0ffc55a59744fa955a9e65bfd8133b908249
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            QEMy.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\QEMy.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7bcf87d0edbc0ef0ee43edc8ced588530a2e97d0f874b34232a73d18371a6937
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            QIMi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\QIMi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e1d26bd4f7c43058a1d107ed4258d99bdba5f0d6c6332ef819d40bb3e87e4a96
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            QMEU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\QMEU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3ecc8510b0ac83b3abf91af017e4883eca39baad70794c1ca0d60496e7700ef3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            QYgQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\QYgQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b6952de2f82dfb8594ac1f3c9198005a38589c6b61e0f8bd7eae3efc4f317437
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            QYwo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\QYwo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 df82afac2b8c44e1fd3d673367b026a8678dc008e6f5bc874d0b474c7c9e33ef
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            QogO.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\QogO.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 af399fe73d4a2a17294814e1c14c9e3256c32f60758cd9c03470842e1ee8730d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            SAEQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\SAEQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 831dbdca3966d57d344760a5c333147098c2acc6e55adecedc3de264c8702074
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            SAIm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\SAIm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d6cb5cedb5a6dc8adb757a006fd6c1f7093cb526aa3f2cd2daa0cf5d93ff7ddf
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            SEES.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\SEES.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 6da3e6070bfae9a1911bafd59a29962115509c9884d383c5642762020915b246
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            SEIU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\SEIU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d218119162b1179ca08db99ffc29135d8951329db8698c409ab7fe4a1ba059e9
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            SUMA.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\SUMA.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 099470bdf0662672008efc75798ed2997a93dc33b620401a4378a60c418c803c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            SUUA.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\SUUA.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 fe4ca37882b374fdfb4ac711d1c792df9114fde85e783e30bc01d12a673b860b
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            SkYg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\SkYg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ba3a07e4a66a43f49d7195cca571604975404fab404cebe6516e468ba7fc26b8
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            SoMI.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\SoMI.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5c8b44bb96b0a72751c9575b3ab47f9b9ecbc859c41cdf79109a3f3699ae2e66
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            UAUE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\UAUE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f79d3de849965a2a581139cd537d44e36ff92c3096038ad2b95c19e94fa6e25d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            UMcE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\UMcE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b60e057c599c7354703284f4c183aa76b2001c5e1b4b1aa0adc532824a8ba7e1
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            UMgo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\UMgo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 3.1MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d84c4e2aa1482b6b4fee4dfb5e0fda2fbefdb1e91ccec95982c6d498b34d6d9b
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            UQMo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\UQMo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d4152208d547e9f136ad53aec96cdb176ff39fa4efd6d1d53af7744076aa5eae
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            UgAE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\UgAE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5b09b531d9caf80b6ba1b4f34cf34a3c5e48de9db20ca3442ea948c7f05a4ff3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            UgQs.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\UgQs.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f4d6dcdb1a10df9038de3555297f476a88887562cd65080806d6799b7d5d9be6
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            WOgo.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\WOgo.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            WUIO.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\WUIO.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a6196d7cf017697b1b9b865401a736ee3744b8c925ba369e6b34b5a5f99084a5
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            WgAi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\WgAi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 77b0d6166937db34fe515e7dedab63a23274b7eaaff9b2c1dd55bc115e956087
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            WoIs.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\WoIs.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 70d8814be870799f2cbb3785f12af67d8f6533137649df2200b06fe253bba924
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            Wosy.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Wosy.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0b4856f4cf0576900dc1a9d86a3199397a3f91bb996afa822de69ae52688881e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            YkYo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\YkYo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ae9caacf0117dcd5d9c05813818d08546cf927a609a8631b08e19b4e9880cf6c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            YwYQ.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\YwYQ.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            aUgS.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\aUgS.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d95ba8b1d69ccf8c62fe4f1a73e5515d59c7696beb933491cf3ed3a81cc529f1
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            acQK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\acQK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ee27225f65c79b790a7a46327c515bebd5815f335f7bf6c9b6e155209c6ce831
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            agcw.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\agcw.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ee40d7f1dc5429c8018ebd27d961a6302a14e0492da419bd87b576db2683ecff
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            awIU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\awIU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 1e14c50b40067589ed5e8d91bfcce9f0b7a95850ad3b2a26cd27d7103be0cb18
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            cEok.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\cEok.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            ccYM.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\ccYM.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            coYM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\coYM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8b8258835bbbce5e69a97ef4ba62706c87d1b17fabc59f26ded799f12565b536
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            csYa.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\csYa.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ce90b9271cfa1c9bd76b2f5b3fde5fcce0ae50b58346a71f0f5ca9f85b62e398
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            eAsC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\eAsC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 59016b2fd632d85de45fd8f719e5a71dcdeaffa5695436e6e8916eb2aa6310da
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            eAwY.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\eAwY.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0ba93745554772373b027294b95d4c260faefaeea764e020a796e26d3f268b07
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            eEEe.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\eEEe.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8ec9d729e9ce82282b1d8ba19503babc183ee2589bac8244275a2be88e884d15
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            eUgs.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\eUgs.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 9fd8a12565419a27a1d72c373d1063b82dd70e5c05f50395e3b94a60d5a10b6e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            ekYk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\ekYk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5172d3002aebf05c219a85c3a70af7ffe863543739d670f9cb4b80ea40ca7a29
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            esAo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\esAo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 14743b49ae57c5acd05ea56b4ee158e7943a2c2545be4d80463ec679127d6931
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            ewsi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\ewsi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a2b0ea4751a4045a5f5b5db22b3b1a18a6e3b7fe7de5b0cdbb32cddd00f6eb9a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            gAAo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\gAAo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 fd636559c5b9ed7d74146cb598f85bfa4879ab16817c552a9cad9953bbb82e48
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            gAgK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\gAgK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 17f1b815201a31e0041d5cd69d80fb7488512b092f1b9f4446a3e2869efdcc42
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            gQYu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\gQYu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b10b74423a887a897f43d17f69b35828837f0792b478146d1822ab7f53af02bf
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            gUUy.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\gUUy.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 881b7dc70f7557f1d8be25776065fbaed699ccab23ae4aac305676482a563821
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            ggMW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\ggMW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 575df8176c5ba9f64ff16a65af569f5cdb356d76c19354ca543c46a5ad724729
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            iUYU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\iUYU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5421086c52e2cf15674987f7436200b570d8e5f30321d556fd1297c26db118b0
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            iUko.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\iUko.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7f24fd570c38dccd513f462d7853e2dc5125ced8bd90d9042a0f6c15d4dbda58
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            iUoQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\iUoQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4d1cd74a66fbe6da9196fccb2bf7d3a25ea5122c2a5440dbeb2c35a25ec6026c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            icAC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\icAC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3004323dffae2f31911715cf56fcd5dcd370b263801d2722d5f7282e0325d866
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            igEi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\igEi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 3.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c7d43c52f007de4c065acab550b709dfb7a82c2271ed7f058bbdead1bdbc91e1
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            ikIK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\ikIK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7d3fe1f9895c280bdd4052b6d53f07669d504b1bd913b844e8c30710056e794d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kYIE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\kYIE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 82bda55144f0c363e5bf74e4afc19a38c9a2ed8d25ae69b634b42d44e29f2392
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            koUa.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\koUa.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 076751cd87c6069fdf36b42c3312f07a4e4e707257787d5c760e477bd1965186
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kwkc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\kwkc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4e3dde48717c4279994002aab5a2cbf3581a6e292f611848bf21a714d16a8ac1
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            mMoc.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\mMoc.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            mUUo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\mUUo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 31d284bc2b19cd2aeebd93e9612587715a92a613ca92b53af12e2ebfce86d0c6
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            mkEU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\mkEU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 9a79c0b44c7a8434df2370644848765fc8ec8f21e19de1b800114203d730404b
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            mogM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\mogM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0539297c80ba6105cc4507f186cb67555f7b307ed1dfac26ebd57651441c0d15
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            mokM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\mokM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 770441f9acdd7b49299c804423771d0efdbfa073b20b7de683649fd167856f94
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            myEE.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\myEE.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            oAoq.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\oAoq.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ef3453fd2abda265536c8feb9a19d651c8c6ea5ea57b862192ec6113908f2119
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            oMUs.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\oMUs.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            oUAA.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\oUAA.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 6b5c0e5c60691c78e4f18351ef693354b0d862f15d27930a3ca55534acf56303
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            oYcU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\oYcU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 283f3141700b83553dbd785bdf6a32630c16a9a063c6b6b5397d4becf36ca43d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            ooEi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\ooEi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e0f8541e362512cb6871800bd59ecbd1051d01fe9c2e02432de0400d96ab80a9
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            owgM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\owgM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 2d8373068c94d6b515a7be86c143c84196b6327566d2f5dc73b4c9347353f0dd
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            qUcM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\qUcM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3b734cc2b4e023949c5d6c373063e8038a3c2aadcdc706de504968b3e02c9c44
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            qcgu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\qcgu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 fc26327fce63a0df736391de653dd75d34738e5b965cda9bfd4e78fa98f1f60f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            sAkg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\sAkg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 6892510d512ab0185886b5038ce56082ab6f991efb488497bd1c14c545c3e3f1
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            sIUk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\sIUk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 85759ff2061f5bdc3873449c86bc1a9a1624b38665460de8b2ba4d308a9087e5
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            skMm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\skMm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7cf7028d7fc9e8b8b9eba566b771b24436dcdb561a660057eff368ea78ec4d9b
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            uEcy.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\uEcy.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ea362b625ec7b249da5922b5664ee17bff18a1c9667ada50d8e3b4ea01779fc0
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            uQYm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\uQYm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 db0322cef8856b0bbb6390cdfb66deb9418c91ab308421ebf5adf9bd29659d6c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            uQwC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\uQwC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 caac8949eede9ec222b3d4ef077542de883ead4a07d8565a0ec12fa78a45609d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            uskE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\uskE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 17387c89fefb1880ab1fc4051521ab81897a6319bb3d74cf4158b72cae696a87
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            wAIq.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\wAIq.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b21d7a616cacab7b7c9eb372e810e7aa43f1d423cbd45805986c7a0b08d8d841
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            wEEE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\wEEE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f04e0b938ceeabc32ea26bb176bd491746222ac0ead7008cdd712d75ab5c5863
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            wYIG.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\wYIG.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0b107758f8281e1037e0c80bd240615874dde180a01d97c64c307f01726065c6
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            wcYy.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\wcYy.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 005c81e8f0bd42888b94a268f8acbdff66480a3073be0edc8e043f82bbefe901
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            wwoW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\wwoW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 dccd50c896085ec27c40c762cf6c010220ab8c2ecab4d21e50bd7481e3c070d2
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            yEkW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\yEkW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 772a703f1db48a04d0d3f2e0b47ac4f20d5130911e55cef3f8dd5711de7c6dbb
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            yEss.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\yEss.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f47279ca8f4ee6af08f59759943c58f37c0130bf39b38629dfacc31722cfd51d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            yIIg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\yIIg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 42625691d1036ba5f008ac8a8b78c77adba03ad8d28cbcae005c756ea8d46641
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            yQAg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\yQAg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e2e03f06c86fcc4acfd8b084ea81668b721bf571931fbef3efd45b9f39607773
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            yQMQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\yQMQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7efc226433532ef3ce61292c23c7536f12cc128aec1cde0df926de11120bd397
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            yUIY.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\yUIY.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c63a11530df2c79cd1916dd199a3117afe4d5e5c84dc8a416075a0349664d701
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            yUwu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\yUwu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8127121d32baa62fa5922c12acee071e7a3c5819328cb0d79bfbcd01fdf45c48
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            yoIg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\yoIg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 2fa828f2a37a8ef538e868221c9e07e09bed9b411e68950722233b929bc58e63
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            memory/400-2238-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/580-2075-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/624-235-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/796-1931-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/968-1918-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1040-257-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1060-2012-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1152-186-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1400-1891-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1776-121-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1956-2053-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2236-658-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2296-244-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2428-2084-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2512-2031-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2512-2044-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2520-226-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2632-266-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2720-1829-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2720-1816-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2848-1981-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2900-1972-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2900-1959-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2996-211-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3012-2003-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3028-1797-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3100-1851-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3204-16-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3204-2219-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3212-1994-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3308-1820-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3344-2035-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3384-1838-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3388-2214-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3388-10-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3484-1909-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3692-1949-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3776-1940-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3820-77-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3920-198-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3936-1764-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4156-779-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4364-2224-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4364-19-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4424-1963-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4560-141-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4584-0-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4584-32-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4584-33-0x00000000021F0000-0x0000000002210000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4584-1-0x00000000021F0000-0x0000000002210000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4728-1878-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4836-2066-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4868-169-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4888-705-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4888-622-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4928-153-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4956-2025-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5000-109-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5084-2233-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5100-837-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5380-1860-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5384-456-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5404-1806-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5404-1793-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5540-535-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5544-276-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5584-1869-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5704-388-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5740-1900-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5808-1787-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5808-1770-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5864-1774-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5916-97-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5924-65-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6000-916-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6056-53-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download