Overview

overview

10

Static

static

3

2026-10-11...ck.exe

windows10-2004-x64

10

2026-10-11...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/10/2026, 02:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
  • Size 1.6MB
  • Sample261012-cfnqzaev2x
  • SHA256 68579c0b744736ab5c8fd45f6c7316485ff64b347f3261154987992e0f458c48
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 64 IoCs
    defense_evasiontrojan
  • Renames multiple (121) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs
    execution
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:6020
    • C:\Users\Admin\AIoAoEEs\AEUAUcwM.exe
      "C:\Users\Admin\AIoAoEEs\AEUAUcwM.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      PID:2280
    • C:\ProgramData\AgEYEIoQ\AQcIcoIk.exe
      "C:\ProgramData\AgEYEIoQ\AQcIcoIk.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:4792
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4732
      • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3464
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4728
          • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1532
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3784
              • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1392
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1404
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:6008
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1760
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:5528
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2476
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:672
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:6140
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:3316
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4832
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:2072
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:1400
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5984
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          PID:4140
                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                            21⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4252
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                              22⤵
                                              • Executes a command shell one-liner
                                              PID:3400
                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                23⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:2788
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                  24⤵
                                                    PID:424
                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                      25⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3844
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                        26⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1020
                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                          27⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4364
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                            28⤵
                                                            • Executes a command shell one-liner
                                                            • System Location Discovery: System Language Discovery
                                                            PID:6124
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                              29⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:2928
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                30⤵
                                                                • Executes a command shell one-liner
                                                                PID:1204
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                  31⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:2976
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                    32⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3052
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                      33⤵
                                                                        PID:1524
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                          34⤵
                                                                            PID:4888
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                              35⤵
                                                                                PID:4396
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                  36⤵
                                                                                  • Executes a command shell one-liner
                                                                                  PID:5828
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                    37⤵
                                                                                      PID:5952
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                        38⤵
                                                                                        • Executes a command shell one-liner
                                                                                        PID:1912
                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                          39⤵
                                                                                            PID:760
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                              40⤵
                                                                                              • Executes a command shell one-liner
                                                                                              PID:2968
                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                41⤵
                                                                                                  PID:5892
                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                  41⤵
                                                                                                    PID:5568
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                      42⤵
                                                                                                        PID:4588
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                          43⤵
                                                                                                            PID:1788
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                              44⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:2192
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                45⤵
                                                                                                                  PID:108
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                    46⤵
                                                                                                                    • Executes a command shell one-liner
                                                                                                                    PID:1712
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                      47⤵
                                                                                                                        PID:4388
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                          48⤵
                                                                                                                            PID:5712
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                              49⤵
                                                                                                                                PID:4760
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                  50⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:2504
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                    51⤵
                                                                                                                                      PID:2160
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                        52⤵
                                                                                                                                          PID:2724
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                            53⤵
                                                                                                                                              PID:3512
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                54⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:5484
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                  55⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:5524
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                    56⤵
                                                                                                                                                      PID:6988
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                        57⤵
                                                                                                                                                          PID:5348
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                            58⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:2940
                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                              59⤵
                                                                                                                                                                PID:2964
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                59⤵
                                                                                                                                                                  PID:4468
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                    60⤵
                                                                                                                                                                      PID:4260
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                        61⤵
                                                                                                                                                                          PID:2660
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                            62⤵
                                                                                                                                                                              PID:6200
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                63⤵
                                                                                                                                                                                  PID:6412
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                    64⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:6480
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                      65⤵
                                                                                                                                                                                        PID:6516
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                          66⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:6820
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                            67⤵
                                                                                                                                                                                              PID:1772
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                68⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:4604
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                    PID:2796
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:2588
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                          PID:3928
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                              PID:7064
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                73⤵
                                                                                                                                                                                                                  PID:7112
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:7148
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                      75⤵
                                                                                                                                                                                                                        PID:6884
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                          76⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:2944
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                            77⤵
                                                                                                                                                                                                                              PID:6068
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:5408
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                    PID:6332
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                      80⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:6376
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                          PID:6416
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                              PID:6648
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                  PID:6632
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:2756
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:3680
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                          PID:4076
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                              PID:1252
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                                                                  PID:7012
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                                                      PID:6868
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:7164
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                                                                                            PID:6664
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:1088
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                                                                  PID:6972
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                      PID:5096
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                                                                                          PID:5064
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                                                                                              PID:1844
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                                                                                                  PID:2412
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                                                                                      PID:1208
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                                                                                                          PID:6476
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:3184
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                                                                                                                PID:700
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                                                                                                  PID:6596
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:3968
                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                                                                                        PID:1432
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                                                                                                          PID:1500
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:3520
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                                                                                                                PID:2352
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  PID:5104
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                                                                                                      PID:6928
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:1492
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                                                                                                            PID:6696
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:3816
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                                                                                                PID:6320
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3632
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5304
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:6692
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                                                            PID:936
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:6800
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6528
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:6784
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:992
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4524
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2464
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:1132
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4336
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:7088
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5680
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6880
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                    125⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6168
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6776
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6156
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6468
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6340
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7068
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6252
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7160
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2728
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MCcgEEQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6740
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6624
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6672
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6808
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3636
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6788
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SwQgQYAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6196
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6312
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7028
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6208
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6356
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AgIcQUoo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6704
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6244
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PAoEEQoA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3716
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7044
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ruMMkwcI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3524
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7020
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FkcAcEYE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6920
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7084
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4068
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qeQUIYgs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6724
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5672
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6812
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QywgMcoY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6660
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3440
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6668
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qMwUsowY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6076
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6400
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6788
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:464
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LmssoggM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6804
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5196
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6308
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6616
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vusoQsUo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6172
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6244
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6980
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:908
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JaoUAMIY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:480
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3268
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kuEswAIE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4080
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwcQggYE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7060
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6912
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7024
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6700
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IkMAoQIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7144
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:540
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6512
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6508
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6812
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BqwQEkYw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6652
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6600
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vMUEksok.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6232
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6552
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6720
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pKYMYIgQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6432
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6440
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PCEwscYk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6384
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6740
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KiIgIEoc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6264
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5688
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3160
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CmAQUIsc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7020
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6272
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eQwQcIUE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6700
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VEoIMIcM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6860
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FcgoYcYs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1292
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                          84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3636
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                          84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fOgUkwUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6576
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6528
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6688
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6592
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pqQsIcUU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6388
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2340
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6380
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6436
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6172
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GywkwgMI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6148
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6712
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                          79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aGsgookg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6284
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5424
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qgcgcsEY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:908
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1900
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7084
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lIMYUogo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7092
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6856
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TsksUIss.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:428
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FqEowccw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6696
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6404
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oqoAwoIk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6608
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3440
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2340
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ouUUoQYE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6528
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6544
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6552
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CgYIUgkQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6572
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6784
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6236
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6244
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6252
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\luEgcoAA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6276
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6440
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              60⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TkYosQkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              58⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3524
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LmcUwkcA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:464
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:7028
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7036
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7048
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SSUkIoUM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7072
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      57⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3700
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3520
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uMgoAggs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      55⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6912
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    53⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nCocscQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        53⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:936
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pyUAMIAc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3372
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CmAIMkQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        49⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KwsIIkgg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        47⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          47⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:944
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hgYgUAQc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          45⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:436
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xwkckoIs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1636
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        43⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          43⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5860
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lqUEUsQY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        41⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    39⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kKEAwoIE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      39⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ouwgggIc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    37⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3436
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              34⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2412
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  35⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QkQUksYw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5200
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    35⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      35⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    33⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PusQYgYY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      33⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3524
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3528
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XkYMscEI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              28⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2660
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mCAUsYos.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  29⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5688
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AOcMYMkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1960
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3520
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UAocsAwU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1936
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              25⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3636
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1896
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iqsAYAIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          23⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xcEIIkoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3528
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TCoIEwIc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      19⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6092
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                PID:4228
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:2964
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:5892
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZQMMIQoc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  17⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4376
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            PID:2104
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:2920
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:5952
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GqIMAEwo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                            PID:5112
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                              PID:5832
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        PID:908
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4120
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:5340
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UoQMYwQc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                          PID:1168
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                            PID:1712
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                      PID:4220
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                      PID:4604
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                      PID:3748
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\igEQQAoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                      PID:4696
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:4532
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  PID:1184
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:3984
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  PID:4416
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qEgkkwQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                  PID:2620
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:4304
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:6060
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3248
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                PID:2976
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hWcQcwkA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                PID:4752
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:6024
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                            PID:2780
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:3220
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            PID:3372
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lasEsMQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                            PID:1456
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:2480
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:5076
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2436
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                          PID:2756
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gOssgogo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                          PID:4460
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:5728
                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\tSUkYEoY\KsEsoocs.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\ProgramData\tSUkYEoY\KsEsoocs.exe
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                        PID:712
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AIoAoEEs\AEUAUcwM.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AIoAoEEs\AEUAUcwM.exe
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                        PID:3992
                                                                                                                                                                                                                                                                                                                                                                      • C:\ProgramData\AgEYEIoQ\AQcIcoIk.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\ProgramData\AgEYEIoQ\AQcIcoIk.exe
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                        PID:5740

                                                                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                            Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                            Resource Development

                                                                                                                                                                                                                                                                                                                                                                            Initial Access

                                                                                                                                                                                                                                                                                                                                                                            Execution

                                                                                                                                                                                                                                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                                                                                            T1059

                                                                                                                                                                                                                                                                                                                                                                            Visual Basic

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1059.005

                                                                                                                                                                                                                                                                                                                                                                            Windows Command Shell

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1059.003

                                                                                                                                                                                                                                                                                                                                                                            Persistence

                                                                                                                                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1548

                                                                                                                                                                                                                                                                                                                                                                            Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1548.002

                                                                                                                                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1548

                                                                                                                                                                                                                                                                                                                                                                            Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1548.002

                                                                                                                                                                                                                                                                                                                                                                            Hide Artifacts

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1564

                                                                                                                                                                                                                                                                                                                                                                            Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1564.001

                                                                                                                                                                                                                                                                                                                                                                            Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1562

                                                                                                                                                                                                                                                                                                                                                                            Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1562.001

                                                                                                                                                                                                                                                                                                                                                                            Modify Registry

                                                                                                                                                                                                                                                                                                                                                                            4
                                                                                                                                                                                                                                                                                                                                                                            T1112

                                                                                                                                                                                                                                                                                                                                                                            Credential Access

                                                                                                                                                                                                                                                                                                                                                                            Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1555

                                                                                                                                                                                                                                                                                                                                                                            Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1555.003

                                                                                                                                                                                                                                                                                                                                                                            Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1552

                                                                                                                                                                                                                                                                                                                                                                            Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1552.001

                                                                                                                                                                                                                                                                                                                                                                            Discovery

                                                                                                                                                                                                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1082

                                                                                                                                                                                                                                                                                                                                                                            System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1614

                                                                                                                                                                                                                                                                                                                                                                            System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1614.001

                                                                                                                                                                                                                                                                                                                                                                            System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1016

                                                                                                                                                                                                                                                                                                                                                                            Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                            Collection

                                                                                                                                                                                                                                                                                                                                                                            Data from Local System

                                                                                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                                                                                            T1005

                                                                                                                                                                                                                                                                                                                                                                            Command and Control

                                                                                                                                                                                                                                                                                                                                                                            Exfiltration

                                                                                                                                                                                                                                                                                                                                                                            Impact

                                                                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0323cb1cf0c677c1f6124c80fbbf24783544ae78782a8c405e9a35f94807d654
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3197dfa7e36f5a5cfdeb8e77948ca5c7fd3b5331ef14a6495a50e307d8c2fb06
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b1720da83a750a93eafd378129ac711d14e233d5cc21e1bee9dc277c33e7d70e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f23bd8d1b92804e78b5786fae7b22c7f018be9eb8cbcfeead2cadf36836a701f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 774723817c2a231ce20678d48d5c0140e101d4293c9876234d2a28d18612c025
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 67a0f02e1074417c5fbbaec15605527940c74b899330adf750fe1711827c9847
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 6d0f2f1dde80772839b5f3cf48f7d51be9136299d10e03d43e053386304c09b6
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 1640ebbc36a38f656c5880750c7b7b934d538eb476c9deab748cad5c92cfef2c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 42e49512f8865a4b5923aeb974fd818dc4204a6c71f43a9a83ad0d341c925980
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d90ce7833657c066a8538bb20e2e14404d61a5e7cb8c72530ab89b190600d49b
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 50324e5f9574e5450880b76834bd62869d7c58c8a37758dc7e43eb025b39eced
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 55a9b2bda63929464afd5daad47143ba106e7974e104a7fdd8470540f9c6ee92
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 2ad99fa913fc898b6640b4703708f3ecba8058649f544faaaa3271d7dea8ed7c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f0ad3b315a62091100e9b5f3ffd2ff2ee28c1ea6ec1270501dc440f9b4d5e59d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 cdd97f7a08e4d57fb094ff467651a0e96dec2fa61daf1d5555a00c21214a0942
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 300f8c86d225423f70ec9b453bf68976f19740029548af72e9d394d3534739fb
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 fd4064818ea6d85e5e7977430169a586101ddec7bed7516b181eebad4fb13880
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3993e9bf07638a8cbbcc5317d40350e52df66ba516c67e38677dc878e2d87289
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 845dc4116bd1d7e21dadd8bac7429aaf62426742e5e6116d8f479bb4595109d1
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7fc30119e43a702dae7c0e2917d371e1c066a31ba5cd92c0b0e9957765946477
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 28ffd4fa260d00dd2e3f7eba4d0f6fe0050eed880ea0c03ac4f2f9524f62a460
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 af0dd3db0742ae02be7a075101796c1c178af5b4ba64358fa76394eee75202f5
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 30735a07c6f6beb0a7b1592b503a020c431a6aa7c2ba210794e4813e05a22aee
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 57aa6663da6339aba5db05f75e944c5d6aeb112f1d6bab9061bc74c8e97d5d12
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8a551ce2e7b19a1f0dafac22c2ae61ac3911b37d341fc8824f7ce0cfc1b035b3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3aa10ae3687b426f99bc5e8a5b6dcabc10a02ad8216b0233dff05c32fad6ceab
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 aee44aeb85df7a776758434a54facd4704a2e6912d06d8d4177e3103616aa7ea
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 489e464f7af43a23a3ff06aed8b0fe6c7f4d0a30470ff269be4f53058d012e2f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0603557186c917a2d4063f8cc943920b8146c24970928772b26033513c35b34d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0234091e4e1b75b2df52f1b425cbcb20c9ffb065d040afc6a7d34cf0a300f46e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 33a3d47af9726b08c80db3a6f7f4e5482c539a857ed475462bfb71914089d08f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8a8f177bcbfdeaf89e25e2d2076201cbc1bda8f765328c74589a488d3bdcaaf1
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7f6b312ff1ca866fbd096d1b14008346838883899145218b06c619d7b3aed1e5
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3a92ef50de32ce386208fe205b626b678b5e0a4bab94e57a3eff959530722f18
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d63682b9ebfe387445b349b4a611d14d5d1b653d98d432269fc36dcd0b096770
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 fcc87b02f2add860345f981bf66c7d96fe7b29e657345a833a9aff5426fa2042
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ff53b838e895d2341df5348e09ec95c0a07a23dfd3ddbb198d72f01aa5115d46
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\AgEYEIoQ\AQcIcoIk.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 08cacb91a10254dd1077b0f77f3e4322c2a145de83ee19b203180957178463bd
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            IqAo.txt
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\IqAo.txt
                                                                                                                                                                                                                                                                                                                                                                            • Size 10KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3594dd1ee7e3631c98cbbb614ba7af0392c375a235137700d7413f33c36fc927
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            KsEsoocs.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\ProgramData\tSUkYEoY\KsEsoocs.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f657bca062bf4efe5eb5df2c6a29b43d0d671ca046299df9f7735acf5dd5805a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 dec56ceb4247a2a181de9ccdadcfcd2b25ce9cb2fb9e30c9a18747619922bced
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 662365984573910c4428dc3b98375759c1390cb01017cd98b7e597badb906f4e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 62b25b1f16af775b53238bec26820f918b7fc40cb8445a32600ddecd06603f03
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e99a1241f102b5bab8218a63e2a7a7361701c75fcdc260a7431d42fc5f10dc31
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ffb6bb369f5b968f7eac419cc6b03dc466427d23171a588a42e53902a54c380a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b943c21a374d08869a59d7249b533677743789e5bc0807a6152085c91df2ec3a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 08f89912abd046c80c6ad3963e3d960c30051e671f41f5ed06bdba965e2e978a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 54b1103c9953d9776aca15c3e02cbd90bcfbf8f9a9fa0e1d8a4eab12c91361cf
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 6f975bbf52df513c53b265fd68a2d6c16bbf94c69f968efa4f0c2eebca2ac445
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 89195ff94f54232dedebb9c454f81194fa0db582ee6e3171903e813f91933135
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f45f9ab110dae63c609811d17643f6de0eca6bd799bfbb487eb6c1ab0fc722e6
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 bf3296a6717cb4e3af7f166f6d7c61569bef67fb9e675ee9c71d17953082affe
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0fc22a9fc93b3e7a7f59a6c0708138adfd57341503cd9a1c4426988687a691d0
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 925d4806beefa9796929b8cecc9f972c7964395d5ad343f81ca2980bc177fc3c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f016729458ecf168e3ead6b0542398db75bd63702255c6ca94ceb4e88cf7089f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 238a6843f72af5c65685306aa8f5631894b4ea7eee1676f0dbde055eae9521c9
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 2db7b359a19eead45d306836fe9745b6cb4638c490c2d1ee73795abd14c56847
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a52a0c181a6ef311e258ff9388cdae065ffb2ec26d8cdea890b5fb223513bd0d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a527281a1921d2da895c0e51ce6c0d007b5c7168442dfb0e6640de5088519e32
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c553142ed5c15ce387646adbfad32085cc6f643486920fb7e0efd18930c33557
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 547b28f1d6d25a2a12200f8694c985554a3df23744a514a2b2ed7ebf7bf3353f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 fcd8a91b5c60cd267f88e69888b2d3a6241950e629d5f62fbee02f45d3033ee3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 9b2f0beda7b668b1a00d25f1405fe91cfcca96f31774d75eb4eccebc2f51e626
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 1b9a99dc3465998b03da59e474a4e0bbade0d036eb729a0a4cb134b1fe8d8048
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5acb6f4a7414f1ddb4b7d82c02190211a36cc901c8e5743344c4c857f7bba066
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 1c2f43b68675147a6871c50f911ffdc5cd02c867d31489f2fc20d25e33c6e69d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7052f99dbacf50c1821d3384d075598059a114c555eb1b4f0599b3db154d563a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ed71c10e8a6606227bcdda6807b1ba8b8677bd0964a92ce9507d8334273d5a9e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 fca8218d50beb55c891a95131527544b814ced9f46f2c5372bec143262fb89fc
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 01451c71d229a2aa6d8de1712bb3ecfa24fad504c0aa24afa9ce7c3341c43ee7
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d15904aea81a0d892a98780412ed8e7f10c592358e1929e3b0ab568a545cd9a1
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3a169b8ddc73b8d0d25d8836bf968b7b89e5013e4697e244d0c6aefe304c0881
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f288836605156995272cdef6a481a42d49db85b188c19daf87def5be22fbdf26
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b2101f2c64ffced53a44abf705eed2a5820527091fef3e076e074b7d404a1d81
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 2ef9b88da1f2f39995f57d69883066fd9ff8f621be2d697ef9d3bb68497fc88f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 317b789da4c138dd2e06008335fd4e4e6eb5478784d578ecf058299c1e34d5b6
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 61dabc9f43e025c98ea9d497f470053891499f2679299b63eae262b05f079cb6
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0b20ab64478414f9181c22c4140d6c83436a0fc79ffb381f8ce0b13f0073244b
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3346b1c8204e5300120b00d50b4bbdfc60779f4d6b1bb63ca9f94eb0a7896697
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 399ec82ff5de14e20cc86afca1be6e9d72d85dfbe60547ddebeafb8f59420ee3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4b8ece57ef0e15ba72b46606b654677fee980f812bc979be41fb701b26a390a8
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a2cc77921596614cd1cf35b32cc754ffe7e787b1f32bcbb8782b95b1a3200ab3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 846078704a806a4ecd053472daa25f13d66bd25213b283cd1708ce4c87206cf3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 20a7f37ceaca516b90ed5429c460368a0b1205b42995d456efbed004b254c639
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0763edbd5aa30f8c1611a51cc038a70e7088c351d4a72c6541f00b4f6f0c54ee
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4db4d47628fee62e6b6ac1bde1e8f4d863b069ebea2ec3a0b41e6a5fbe30f844
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e5151f99506a20575e6267d3f442dc1684344a8a3f0d0ade7676cd307537d5e3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 abaa343d4c0eabfa678310503fbbf72fbb6a355fbc82b1c61fe01190fb59fdb8
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 dc4adffc0d1a77239a504b67b389ac8441a9b3fb1961be2bb8034ac4ab7331b1
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 74538d10e65269f5ecf9dc22b8c0fa497f9387e53d9bf7826454e89b445dc300
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 de341e089a0b630cf59686d10bf6d1f619a11e7fea04db24119b6c8afe9f9e39
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 51ad640bef695da6c632b2331e0d2b2b39d6367037c19160db8ae94bee631cab
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5aebf5d0343fbde4896c5fde4ca8c677450c0f12b085e4abc9d57d70296a5f3a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d7abfd49d15f4d306b2d3ed2782d6f893ab66d7ffef6dd06e60dee3812c8dceb
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a5c61c4af48b68588b53b7696fec909e093b3e17d224c12e21270a4260d37e59
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a1af88673b70bc8d55065038cb88370235b3d1396590ae5bce387b8370ee88f7
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 73a79785024fab5fefd1fc360a61b82ed5bfdbab07b60654dab5aa616626b73f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4d383789d5ab2b68e9b339df2518cde3b5a0bc04193b731356f4eb2c6f7ae8da
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 790981ac15851f35c7136fb551bc87e691d273f349f5382d654479f48ebdf4a0
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 353c987b14ce3d3245ae345e81c35f2bf03e0d52ecc42ca483b97aa96a98ba53
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 1fdab0b0ed6a58fd44525c43fc912b1ee352b648c22825f9b96f00a59caff7ae
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 2847bc7348a4a4194f11e5b28062cc8f112cbf2cca5ed91892d00a82e2ef807d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ad17717d9745c6d38a8ad53696edc7413bf43fa6284e8a8e0ea34c473cd1a540
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7d54ec2d3b7ada92376439c72af43291164cc9dfe5335227ebf4c9aa977752c6
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 82d7bc884fbcaedf42926a53945000808f89844cc52e25c6c9cc289e604e9f89
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ceb7cdd6f34b04b1e6a07602ddb5e26f2722d73281bafd310307c37a4fd55fad
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f57666b0249a8f443875c3b70437cda8b3540f3da12e087417ca2d26b48f126d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d9e6157c310f2fd31ae6d7d3445a0bf24cf7d2e7d5bc8c011d1902ea5f905ce1
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 87a1163ee410d2e6f2116bd2059f2f95eb53ee18d328f45cf5b84953fdd78e40
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 cad952de05d7ba2a675cc361558044ad3b3a43fac73f7c3d58916c3308931a36
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 10562601f85a8ae354db865ca6e74bfa36f3494210569e8c8e6ac3023af7c230
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 340e56fa4469fd760cac256822e257cd18791797c237bf2e11d409816e28b942
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7a7dfb3396f69541a7e9b974b294df4185fb1bd869ae08f129c9b874ddfb3883
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 fdea1dbe2244d6620f2cafe8cf1ac1967cad897e027e137e2a23f630f5230bb6
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4deef70de34295540d7c046c63d954034b269557627632b7cb46ea162547a5b8
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d24e85a365a648c93bc80985d9093c7b649d89682f199c8c27d7cafe54607a02
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 2278d1ef395332536e092e4d9f49c7855e302e4c5359a6987ba5adee5bb32882
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c988e327f7fd49c55abb6b804ff69a1e6a98551e7ed8e4b058809288125d14ea
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d4ef1804284d23dec98746d35e82aeb480889ac3dc8f5d641ad5e125c06a1547
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 30f6d825b3094b5af82c9a80351f050ea000f8c7a674aee02fb1b1c25bd6a14f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e3fde53dfabd37de031ca98a0396df21898262c7505196a02e2fa6013dbd9d9a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 98a6895f2bbde93250faaa67d5fb5d24633c882fd38e0f87b1e4bac71f2430c1
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 707013a89b129c12aadd3f0c14fee185d0cb7337b220b2d94f74a08e59f6ea89
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8282d31de3f3bad9254e37d75d2a3ea93ec777e5b51e08998607e89ac05727e4
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 fe8c62cf92a3f853f6d92c3dc3c8a612768aa2912999f2b8fba2f2cd13420f19
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 9b0366023ef5adb9dfd9746330969db8c42b6c62a9acb5935bb3edb82ef4a909
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 853a5313c75a318d56c1e6e73370d5f3bdb88cdd97cc1b7fe20427a18fb61d78
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 9c1ef3590dcdc8cdef1b2ee71b9c73c96dddc17a1738768dbb86333d25557376
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ec5cb8df1606263d1881f865024022277950882b29fdf6acdb7d4e0e6807f4be
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0c9e429f7fdbe676762d5e38af1ad2b9ce37860824a88cec45ae3757a08820f2
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AIoAoEEs\AEUAUcwM.inf
                                                                                                                                                                                                                                                                                                                                                                            • Size 4B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 16ab21fd7252c1d4ea3fa300372ea755904bc76aa1ebedcaf133838414448ba2
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-11_ee2087a1bae130e1c8326bb5e61559dd_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f51ffd0299e2d094d12c03eff3f4b02a65dd417ff77985fb4dd8dc42a0b330e4
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            file.vbs
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                                                                            • Size 19B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            gOssgogo.bat
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\gOssgogo.bat
                                                                                                                                                                                                                                                                                                                                                                            • Size 112B
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            ACsE.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\ACsE.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AGsw.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\AGsw.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AUEK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\AUEK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b29a5a8a24df8f600ed50012a9420327c5efcf045e8ade9d84d94ae7f2a09b4a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AYkk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\AYkk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 86debe2e11e1887d48a2b1acc7cf4bce8ff8ebce5a19b5cf6d92e5d5c2641780
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AgIe.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\AgIe.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 916718f5b888aa8bc391362159fd81897ff6b0af74b67e089ac0951e733ea5de
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            AmMg.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\AmMg.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            CQUi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\CQUi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 3.1MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 659d5a2f4f2963820107fee2b60f080dc0b69dd02cb91e8c47a0e2bd7b7d705f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            CQYK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\CQYK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 2cc9c00ddaa17b8d4184b95c0d240cbe0631cf355c232f5d8a02a6e1b1fb9ebc
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            CoMC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\CoMC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 00b576d67abed94a1be19ced932d883207b6169d88f6ad3d1f5abd8643a9f1ce
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            CsIG.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\CsIG.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4786e84f4ce591c854bd114dfd4eb7ac31606edc9ad6432230cee9fd441589b9
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            EUcW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\EUcW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 27af86f1043d518d246e2d4852d60e11dc8f0ec09a592b660093fae3ef91e4c7
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            EUsg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\EUsg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b33b2c19ad3ee1cc80f1bda353d1d7d38b4f48722aa134efb4ce2b523638e413
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            EcMA.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\EcMA.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 988cae74aa34e493e86cb2ebcbc30053ec6eeac641f7c74f2b90fe3134343872
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            EcUw.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\EcUw.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b8ba3afce0134d93da01cd67c4e9d2173991c3c82cd87636dcfb4abf6b19c5ef
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            EkQU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\EkQU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b7fe252f5b15ec6c68c4fc2bb3607125d45f246286f4fc239ed95dfd17c56c4f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            EwMC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\EwMC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 1c8f6123a74c433c0176a3d2c547f82a8443dcc7c1d0437b988023cd81e0d764
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            GEcs.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\GEcs.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5ee5eefca4a0673f45d735880e277166ea49639e7c2e6712fc4408a4cf57afcc
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            GMsG.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\GMsG.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b213753a517803a83cf6aba13d6d808b4f44ad88b5f0401e4ad89cc8843d1c7b
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            GUAY.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\GUAY.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            GUAi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\GUAi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 592a83cbb250641e4ee0ccf90ff54b389d30a3f642b0a815b9feddbcce2e6e28
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            GYkW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\GYkW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 bda7d91df6addf053f4e1f45c98e98eaa873f2a250dbe06c22e595bf63e61587
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            Goke.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Goke.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e958bf34cb3dea5bbf8f1a00b486e387c3416b36afdf04a314c366587ca3e749
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            IEYk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\IEYk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8cec22af83e7e188a5b66e16a5298f5d1d901592dff58f0ebba2b87b705efc59
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            IUsG.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\IUsG.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e2ae74044aa1c49b115a1d406527a2ad8dc1212c597fd40451d1e06b39fccb62
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            IcIS.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\IcIS.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e5237bfabf46bdd1bbbabde6d56d7e98cdf4ba41f673dcd8a2ae5df0212ee905
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            IcgS.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\IcgS.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ae73e17cf2ad437e5a795ed98937e18571bc36ebce8acbf021dbcf4c4fb40a6c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            IkIu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\IkIu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 965e98e422903d8ac519f91ba5df93b3e22b98cba3475203ee98102f1a543d6c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            IsEI.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\IsEI.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 12168cbf553b87e30269c066be1bf9af4cf01a08a00089678dac9ffe5815a931
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            IscQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\IscQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8e622a8cec91b64669f264623456bcbaf575d0eaad78186b1e243c6e87558911
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            IswU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\IswU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 6f65c96295b7d12690a48da53f5a8c64f9601752580aef27e68b1b76177cc39d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            KQcW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\KQcW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 69d89cd8b0b5b9f5f2b99c680b8d0d9c0c77d4473d29808c395e5510f461d523
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            KskA.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\KskA.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c3a84255c69cf934970865a2e961672aaf37cc94e0e8439cc13699fa5eb8f962
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            MIIe.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\MIIe.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 77ab7a50cc9bcb228b63f5c08104a868ff2ad07040450b817ca97af3b0c6de36
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            MQwS.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\MQwS.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f561e7198e688a507dbf4347b83603c9befc8f90e144b6042fbc724f5d9068d4
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            MUQg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\MUQg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e1bde729949eb14ec742e5ff62d9ebe1a3a82d666131a2b5e7b12971b4011507
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            McAQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\McAQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0d578eb1627cb45632d2a09b539055d6c9d34ede7b157b93cad13e00fcac3fb3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            Mccm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Mccm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e8b790dc7f5e6d338bc374c91646bd19e37612cda00b32e692e4dd1622937a0f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            Mcou.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Mcou.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a20fb75d4fe32e052e522366521112eef49e8b90fb4be869d6d0313e934c3a62
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            MoMI.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\MoMI.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            OQsG.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\OQsG.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 9d2fc3f946a2b1a882efe8d012b538356bf379b44bd5fa784e6d4569a8ad73f6
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            OUYe.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\OUYe.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a669909f6b77d3290187e2cd527babf389922bceae2915afbae401f7819d32ad
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            OYcu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\OYcu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f4e340dfc14f2ae43b3001d86c59e60cff327662bfe73c9b8441f605de24fca2
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            OgkI.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\OgkI.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            OkEy.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\OkEy.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 373cd1ddd8d920ffde8f6169b3cbbefd328b0ae0022ae105b1a5819885f4a12c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            OoIc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\OoIc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0ec8e0173835cb5e4690ced67546f51769a41c03ca7a1533acd460b6960bf387
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            OoMa.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\OoMa.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 cdf2606927a0ce43f96580a1b6f54ce0f4e264a16f33b5aebeb2db7354958ea6
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            QIIq.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\QIIq.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 512b621c2e67886e97aa010241ffb532d6e81d91cf7e4fb6168bbf7462338732
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            QYwc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\QYwc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 245f446963b3df4f138e9350143b4ba6077ae80b823acdb998a9066ba7481222
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            Qcwg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Qcwg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 155595ee12dfee3b129e887bb4470a161978b6329f6507704f37011640bda7fb
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            Qkcm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Qkcm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 78129adc93cf63d5ed3919110b2f5701e845df1d0fd334d02429ce02710fe133
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            SQsQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\SQsQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 85c96cba76696037020bca9eb4b6c3effde2cbdaf21093e408723305b00f0642
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            SoEI.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\SoEI.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 14da862a259398ef6fdf80acc5c2265682720e71be4df86506c324ca39c5889c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            SosU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\SosU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ada1d023857d8740961842957a7409b6e2c75f7f9c3ab044ba9cec73085fcafe
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            UIAu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\UIAu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 45230b5815a10e720433d581e32d0d86ca11132ee6058f6859b53c92c96f3a0f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            UgkQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\UgkQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e480255040e02f1320444a6e7507ad56a002d4f7212a7569da9108b6c76e0056
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            Uooe.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Uooe.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 2b436487a18dfcca0486063f4b6349c48e0c4ab8eeb0f20b97223e539049e654
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            Uska.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Uska.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 260d2554274147c11491f39f38767d7dc58be229c50afb8636cb43eed7906a8a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            Usoe.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Usoe.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e62b91b6410baad257f9ee5726ba1d7e501623fe80da5b4d0b32be9696467cf0
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            WAYM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\WAYM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3bd07ad450548bf0c0b68475d4ef1f7d5ad733dd49875af21ceeaacefda7bf3e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            WQIC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\WQIC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f50a2877df4f88cc2c0c1fa8ac4865238000e07a0096289163c11bb312dd41ab
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            WQIq.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\WQIq.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b9d20b9b098e8ac50ade1e27f01189d58b8f851d71300064a07515f21512adbd
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            WcMC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\WcMC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ec456adaf632be0353a0228f45716f5fdbcafca299168e0f9d19187b06f3415c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            WoYa.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\WoYa.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 589fd7604506ccb422c67538b5b396c9603dafd97ee2231ea9d3ff39349a36dd
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            WokW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\WokW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 89a2a9560a7810103b622a4d4e734a925f5aaceb66e8964017a46d00d862de48
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            WwIu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\WwIu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0ebc87668b0412b3b16548308ddf629697d7625cb6f24447aee231fd7be218e8
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            YEgU.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\YEgU.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            YEoU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\YEoU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 6bb5ea99522499ab85d745b75fad0b7d745822bcb46637305c4a6d59c0094b64
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            YIYq.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\YIYq.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 805d719891cd8287070dc3a938f5466ac2fbbe78b814e9cc07034379f412edb0
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            YQsi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\YQsi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f53ed0492879a9757340fe912c927c24abe3c778570d56f685f175d8f9c9132b
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            YUIU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\YUIU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a4a044a57ba3fcca3c296962696e086e34d98bf3ba6fc371a1703af1cdb23ce4
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            YUce.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\YUce.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8520566a2d56bd5a8328fe9a73935883b397a4c0bff1abd2b5e416d9068fa479
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            YUkA.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\YUkA.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 58ec576091a294d44ceb7081c847193ac4ef1a6777323a8c966fc12a9f20d3cb
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            YUwo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\YUwo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 621ebb7c79f79f12e1c3d5b550cfadb3147ad1dc1212717ed5003430b4080a03
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            YYsY.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\YYsY.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 9c2da8f7fa51503b0a068eba525f104a5335b32e0a46c541c079b14c5dd2bf04
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            YgsK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\YgsK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 6a14a3c61d7615ac12f55b5364de4b5021ca0596cd41e5873e605863090463cc
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            YokA.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\YokA.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 30fe5403651ca442710ae6cb45535bfaf530689452084517922ddfdc10629999
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            YwYO.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\YwYO.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 63260e0f57f370427b619bd59e12b7b1cc274f9657fc8ae50cee6c743d99a585
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            aAMM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\aAMM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 37ca514c7415d1e8596c697f779dea8579194b1996c12723cef3be8b34aa04c2
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            aMMo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\aMMo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 3.4MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5ce9425d722439b255a7d24283edb9d7336aa2354303c1598931c2aa94b10cf0
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            akoM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\akoM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5f5d7b4cd231eabbbffb37b2cb05146499997a0748e84f702b6c72204334e641
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            aoYE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\aoYE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 78127b0bf2001e0a41f0a59bf1854528843ca16d697cd38a29058efc8a8846f8
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            aoYo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\aoYo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 577a938d5234603bc9c76b575fd7febfdbd3798cc18dc2fa267e82466cb2360f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            aooM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\aooM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0e0c3c59cd7a726f4c111fd0a54751233b997e3239eb681476a27a2244a0a87e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            cEkm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\cEkm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 255461c427295b08776a0ccf255226600c3e2989eeef5a5f7063744df0b6235e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            cMQi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\cMQi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d36b2c2d7e99f11f7ddbf4afb96d90ba3bae2ee9a9876d9b70f62caee5e8a09c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            cMYg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\cMYg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4a4b8c01ce4f7ed9bbd9f0f3960ef65b589da90b85c37144a5ed8a1dabad7cc8
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            cQEs.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\cQEs.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e228b105b5b84821e02f19e8c1900cbd652d9178fc50af5e0733915895336442
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            cUcW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\cUcW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4f235878052951b860d2f880f2161845da392411b35fb883d88ee64bf6e16177
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            cYoe.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\cYoe.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 640e1b7f0ce91d70aff6fd3ed477fb62941b5311eb3a47065dc502f595aeeb54
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            cccW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\cccW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d1ab27bedb762ab806c42ff0cf7ef93d8b2e72d1bdbc8d38385f1d4058529ab4
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            cgkQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\cgkQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8e9894e8f151b98c2ddf1c2934c6c202722e62b8bfceb78931c393442030dc9c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            cmAQ.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\cmAQ.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            csQU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\csQU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e7acd1bee20b1d2fa317025488f34127a6ca255dc44208d575eb6fbf592632e8
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            eEAW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\eEAW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 9033205cdd3959759a771f7a1a24ef3e80d1dd4ad6c78d799295b1e060336450
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            eIoc.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\eIoc.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            eYQu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\eYQu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ad80f1ffabbef4a685f7bd160e5f375bef4f52abb26ffbf410ca7f6c5019cf09
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            eoUU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\eoUU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c3a843c9eb3f68ceea7900d9fa8069f094376b68d8b211a49da354a27fcd7822
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            eogw.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\eogw.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e1e58ff45361b4c089d75d93b67ba1d601bdd2ebe15016bba61b9b048057b71f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            ewgE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\ewgE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 7f4c74939e88f0c3f034087bd2226389cb435bdd7cad51061024f8dc5a07cd78
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            gAcI.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\gAcI.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            gMMo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\gMMo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5006aa2319a9f8dc8ef382df8d23ab75a69e357e7d2e9e153c3b29c0d15095be
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            gQsC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\gQsC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0466c6925783dd384c98264f85c861278e203b99b777537772bfad06e669db76
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            gYEW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\gYEW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 302ec6a16bb4bb2ad6c3e8adb154e07c646b9b5001094c5dd5f74c2ca0dddaf9
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            gcUK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\gcUK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f9d81400f63bad6ddbd614067eb3924aeb8f855b2d5a805f0d8d5383312b5a83
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            gkwa.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\gkwa.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 98a10db12257d4ffe52046b88b5c4af7aee435c81040a1b30d5e8547b55d2611
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            gsUw.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\gsUw.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a2f037e0f1c5c515d970dc54f6c0a59d89d1b95fb41433b970342a67a0028d7c
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            gwMc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\gwMc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4c553ce88f86f78fd7e85321615dbfb8f3019d95288b43c53565a6799a164456
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            iQEi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\iQEi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 8d89429c2b6faf8644e11a7208506e0ed6f4044cf32f755f6b93908bfbc8c6f6
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            iQUY.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\iQUY.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 69610e7d6322bc6a5163daf7968c770347ba7b106626d33232a222cd5436470d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            iWYw.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\iWYw.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            iYwU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\iYwU.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c80fe749f313a4c98f53056d10ca7323ea0bcf8b2c7996c85bd80ffd5ae4f8a5
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            icIm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\icIm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 9793e0d422ab4b0f7cfe566e288dec50edb548e359cd02087c2ded4f95c87e19
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            icYM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\icYM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 34f3a096ca363b5dbbe502e698ded4a2975e19fa37a3112146cf6adb9275c730
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            icsg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\icsg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b1619c4ea1b0036a0350de9d0c190ac559531ddd953e6439b7e514ba37b560ff
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            isYk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\isYk.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c944ddcad40a751d55f9455d8a15a64bdee92606e66291d643874e948a592c5a
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            iwYk.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\iwYk.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kAMm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\kAMm.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b148f517d4a2f202391dc78cc0eca1dac30a4092c9c3adb57a4aa489d3f88ad7
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kIAg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\kIAg.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f0b0e51d52bcff3be83f6087c5d90a0ad66b05f9519ddbf79b80f1389a14a01b
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kMwi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\kMwi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 a9d1bcd9099c6ad57b05f45fb915883c91ed3b98a947db5b3b74236d0818fb19
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            kQAQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\kQAQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 48b72945f4f728a7f9dbb5b55ffb1c44d5dc9ef98de8159037b75eb99fd1e6a7
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            keMQ.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\keMQ.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            ksEu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\ksEu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b67f783402d67afc7ee02785687a9952cc47e7f66dedbc555ea4db80e21d2049
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            mAwc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\mAwc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3664ce38617b50e29b019da1a2500c90188e9ee1889e955ffeffe041c6915d89
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            mUcM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\mUcM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e775fd196015cc6fb5963d7032db86b7a732614ef9519c8a9e0de83cf0ed6728
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            mcwu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\mcwu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 276c2f0614d501a1b87f96ed5a9a210b6a8ee977014efb8cfa831c06281ef4bc
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            mgQc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\mgQc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 49a5adcc5f5058b04b36271aefb1b6bd4ce78e2514cfbe2af9423089246412fa
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            oAkQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\oAkQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 9020b394552b5feeee9391228556fc00b681837104439bf81d6aa48fe9239303
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            oAou.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\oAou.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 fa3c56051f102e1856ef4e4e5504a21570e15f9cc63960bd800facd92c5ea2c9
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            oMwo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\oMwo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e270a0a80bbb4b1c6152621e6b0c7d1adc6752dae10229b596033fab506a06a7
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            oQoI.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\oQoI.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 70e03405439b27a1bb4b0a8137df192c5c1cd3a03ae62347a7b0ab255a538d78
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            oUkG.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\oUkG.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 fe87279afe47a3848b87139e38600cef7ff51a7674c9ce432f175bc25bad2b68
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            oYkw.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\oYkw.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 fa173837e9da0f8e201046a7143719672adafcfaec9d6e78f5694e7e2ffd07a3
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            ogku.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\ogku.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 da8afa5e03b285ab11dbdec8cc5d4526b83d738dfeace3d31fa104904bda5728
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            okko.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\okko.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            osUE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\osUE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 2eca04b53a1eff955e13939d5d63d41a19c573802befdac157cded1a2847bc44
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            oswE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\oswE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 41e26ee0761136af4b104129da8b3ab18b8ab518270f37fd159cd6bc0a120a6e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            owcC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\owcC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 d013687247daaf14252f8223eeb929994b4487865894d95f9517509e9b3541a1
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            qAME.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\qAME.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4b9b31b8e2c2a59f43d3f4ad50e23ad7ca94c34a31cbc5c06cd71e48fb29bdc5
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            qEka.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\qEka.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 f5eb6e2943895abf87927f0297e2e17fdec1c5f999461b4aabfbf2ee513c4599
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            qIYu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\qIYu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 c9b45e77d1168bd97b482152444161ab690e4d9021d79abc7ffd6b111ef39ad8
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            qIgW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\qIgW.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 eb0465602e0a442700d2faf61e4dcc3fc6dcb06c46f047067886d0d519bc1383
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            qMII.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\qMII.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 cdab020b5965380c65d26528540d44b6d86e93d7b20181473ba5bcc331ccaffa
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            qMUE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\qMUE.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 1766f9f8ef5b0db4e7cbe6586b947b4974a84fe7f0d0806502749b14f7dc1d3e
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            qQYc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\qQYc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 b48c0ac2ac5f13ec2a421fa7cf8955be1674446845cf0b907dae69e4461f2978
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            qWoo.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\qWoo.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            qucM.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\qucM.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            qwAu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\qwAu.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 0292af3e836e9686ced368f795f85d724e27e09d10696850626d2c4170db7a13
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            sAoI.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\sAoI.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 61738e9f422968caadb3cd35f0b4ea53b80cc816a185e303d9e13a1030c6e102
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            sYEC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\sYEC.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 3.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 677a66c20aa0d777505f12659da5dcb94d6b56b340c02d3963e726bedb167d37
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            skII.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\skII.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            sscY.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\sscY.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 50cb8c787f41f2b552e89a5ebb22848e6bac544f839f97ba7de517eb439a2192
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            uIoa.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\uIoa.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5b471d5efbbd2bfdd188fc2e7e077ea4b4503f1fbf2e49bef5451af0b7298b2d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            uoEK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\uoEK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 4f11a7d12ae1af0a5c4b374bfa5b449d40c25e306bbc9f4037c5ade8c67f7a6f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            uokQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\uokQ.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 325d55d0119f1f48957cee3ea0e803d8490d386f974a094c39b5fd3e994927a7
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            usQY.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\usQY.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 fc156c065fb8c1a89535a8f6b433af544441020db7eb7becb0d764c0336a5f58
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            wIEM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\wIEM.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 6c8da77f420ac734f860386f27863132504c75d73dbbd8464122acc07093e489
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            wUcc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\wUcc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 1446f5a03000ba6faae58795d6cb6cd702e673b437b32833ac37b7e5bb166560
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            wYkc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\wYkc.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 37aaa40ee8b693314915b2342a6955554fc2712427d2e4d0e9285756b081ce21
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            wgAo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\wgAo.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 3298fbcad65deb3b86da00467f2df58f9f83298584519bf315a6ae095d55b45d
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            wsku.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\wsku.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 ddb202f7becffb4da6f7642ca2d55c31e1bec420640e756e7fbc6a13774aa648
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            wwUK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\wwUK.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5a7b3cd247b152f64de3f38f9dfa154cf680fb10b37b9aad3c3f43a80c1e9a61
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            yQQA.ico
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\yQQA.ico
                                                                                                                                                                                                                                                                                                                                                                            • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 bc4ed7d844af9da0a5d2fe12e8db07fbfdf6e0ecd557223b292bd0e9cb6a64a1
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            yUAi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\yUAi.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 aacb4ee52c6084365df2ecb0af4034f016980a80e8177206d7aff7066b79a8f0
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            ycIs.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\ycIs.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 2aaae997cf0f41833f42080357c64c34e13f2c42e3c634f473f67e9a616f2a87
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            ygok.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\ygok.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 872882fb9737a2e61a45ab3e6913bbe18f407d37a963fcbb0fd632a435fe805f
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            yoki.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\yoki.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5832d164e85d7b74cb3f7cedcf6628df72cf2e0638287649508aa9b856fdf713
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            ywsw.exe
                                                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\ywsw.exe
                                                                                                                                                                                                                                                                                                                                                                            • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                                                            • SHA256 5be3acb041509cf43f7a32a341f91f54df7f50ee81ee4107e9f3c26aad1df7b9
                                                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                                                            memory/108-329-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/672-124-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/712-2469-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/712-20-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/760-287-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/936-2324-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1252-2191-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1392-80-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1500-2271-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1524-257-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1532-68-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1772-2089-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/1788-309-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2072-152-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2160-1034-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2280-2459-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2280-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2352-2284-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2412-2240-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2660-2058-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2788-198-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2796-2098-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2928-235-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/2976-246-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3316-138-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3464-48-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3512-1960-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3680-2182-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3816-2302-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3844-214-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3928-2111-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/3992-2474-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4252-182-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4364-224-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4388-366-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4388-447-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4396-252-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4396-267-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4468-2049-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4760-542-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4792-18-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/4792-2464-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5064-2231-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5304-2315-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5348-2036-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5348-2027-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5524-2026-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5528-107-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5568-298-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5740-2483-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5952-278-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/5984-169-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6008-96-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6020-35-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6020-0-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6020-36-0x0000000000850000-0x0000000000870000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6020-1-0x0000000000850000-0x0000000000870000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6068-2138-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6332-2151-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6412-2067-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6416-2160-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6476-2253-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6516-2080-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6596-2261-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6632-2169-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6664-2210-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6784-2333-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6868-2200-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6884-2129-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6928-2293-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/6972-2222-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                            memory/7112-2120-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                            Download